Cisco PIX 525 Specifikace stáhnout pdf (Strana 310)

9-8

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 9 Accessing and Monitoring PIX Firewall

Command Authorization and LOCAL User Authentication

privilege clear level 15 command access-list

privilege configure level 15 command access-list

privilege show level 15 command activation-key

privilege configure level 15 command activation-key

To view the command assignments for a specific privilege level, enter the following command:

show privilege level level

Replace level with the privilege level for which you want to display the command assignments.

For example, the following command displays the command assignments for privilege Level 15:

show privilege level 15

To view the privilege level assignment of a specific command, enter the following command:

show privilege command command

Replace command with the command for which you want to display the assigned privilege level.

For example, the following command displays the command assignment for the access-list command:

show privilege command access-list

TACACS+ Command Authorization

Caution Only enable this feature with TACACS+ if you are absolutely sure that you have fulfilled the following

requirements.

1. You have created entries for enable_1, enable_15, and any other levels to which you have assigned

commands.

2. If you are enabling authentication with usernames:

–

You have a user profile on the TACACS+ server with all the commands that the user is permitted

to execute.

–

You have tested authentication with the TACACS+ server.

3. You are logged in as a user with the necessary privileges. You can see this by entering the show

curpriv command.

4. Your TACACS+ system is completely stable and reliable. The necessary level of reliability typically

requires that you have a fully redundant TACACS+ server system and fully redundant connectivity

to the PIX

Firewall.

Caution When configuring the Command Authorization feature, do not save your configuration until you are sure

it works the way you want. If you get locked out because of a mistake, you can usually recover access

by simply restarting the PIX

Firewall from the configuration that is saved in Flash memory. If you still

get locked out, refer to the section “Recovering from Lockout.”

After command authorization with a TACACS+ server is enabled, for each command entered, the

PIX

Firewall sends the username, command, and command arguments to the TACACS+ server for

authorization.

To enable command authorization with a TACACS+ server, enter the following command:

aaa authorization command tacacs_server_tag

1 2 ... 305 306 307 308 309 310 311 312 313 314 315 ... 465 466

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 310

Komentáře k této Příručce

Související produkty a manuály pro Bezpečnostní systémy pro řízení přístupu Cisco PIX 525