This chapter describes the configuration and operational commands for authentication. It includes the following sections:
To access the AAA Config> prompt:
Table 29 lists the commands available at the AAA Config >
prompt.
Table 29. Authentication Configuration Commands
| Command | Function |
|---|---|
| ? (Help) | Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help". |
| Disable | Disables various AAA options. |
| Enable | Enables various AAA options. |
| List | Displays the AAA configuration parameters. |
| Login | Configures AAA for login. |
| Nets-info | Displays information about local PPP authentication. |
| Password-rules | Configures password rules (enables or disables). |
| PPP | Configures AAA for PPP. |
| Servers | Configures individual remote AAA servers. |
| Set | Configures Authentication parameters regardless of type. |
| Tunnel | Configures AAA for tunnels. |
| User-profiles | Configures local PPP users. |
| Exit | Returns you to the previous command level. See "Exiting a Lower Level Environment". |
Use the disable command to disable the selected accounting option.
Syntax:
Use the enable command to enable the selected accounting option.
Syntax:
Use the list command to display the AAA parameters.
Syntax:
The following examples show the typical output for the supported list command options:
AAA Config> list all
ppp AAA configuration...
ppp authentication : Radius serv01
authorizeAuthent YES
Primary server address 1.1.1.1
Secondary server address 2.2.2.2
Request tries 3
Request interval 3
Key for encryption <notSet>
ppp authorization : locallist
ppp accounting : Disabled
tunnel AAA configuration...
tunnel authentication : Radius serv01
authorizeAuthent YES
Primary server address 1.1.1.1
Secondary server address 2.2.2.2
Request tries 3
Request interval 3
Key for encryption <notSet>
tunnel authorization : Radius serv01
authorizeAuthent YES
Primary server address 1.1.1.1
Secondary server address 2.2.2.2
Request tries 3
Request interval 3
Key for encryption <notSet>
tunnel accounting : Disabled
login AAA configuration...
login authentication : Radius serv01
authorizeAuthent YES
Primary server address 1.1.1.1
Secondary server address 2.2.2.2
Request tries 3
Request interval 3
Key for encryption <notSet>
login authorization : Radius serv01
authorizeAuthent YES
Primary server address 1.1.1.1
Secondary server address 2.2.2.2
Request tries 3
Request interval 3
Key for encryption <notSet>
login accounting : Radius serv01
authorizeAuthent YES
Primary server address 1.1.1.1
Secondary server address 2.2.2.2
Request tries 3
Request interval 3
Key for encryption <notSet>
AAA Config> list accounting all
accounting AAA configuration...
accounting ppp : Disabled
accounting tunnel : Disabled
accounting login : Radius serv01
authorizeAuthent YES
Primary server address 1.1.1.1
Secondary server address 2.2.2.2
Request tries 3
Request interval 3
Key for encryption <notSet>
AAA Config> list accounting config accounting ppp : Disabled accounting login : Radius serv01 accounting tunnel : Disabled
AAA Config> list authentication all
authentication AAA configuration...
authentication ppp : Radius serv01
authorizeAuthent YES
Primary server address 1.1.1.1
Secondary server address 2.2.2.2
Request tries 3
Request interval 3
Key for encryption <notSet>
authentication tunnel : Radius serv01
authorizeAuthent YES
Primary server address 1.1.1.1
Secondary server address 2.2.2.2
Request tries 3
Request interval 3
Key for encryption <notSet>
AAA Config> list options Login Last Resort : disabled Tech Support Bypass: disabled IPSEC Accounting : enabled INBYTES enabled OUTBYTES enabled INPKTS enabled OUTPKTS enabled
Use the login command to configure AAA for login.
Table 30 lists the subcommands available with the login
command.
| Command | Function |
|---|---|
| Disable | Disables accounting for login. |
| List | Displays the AAA configuration parameters for login. |
| Set | Sets the AAA configuration parameters for login. |
Use the login disable command to disable accounting.
Syntax:
Use the login list command to display the AAA configuration parameters.
Syntax:
Use the login set command to configure authentication parameters.
Syntax:
Use the nets-info command to display the currently configured PPP authentication protocol on each PPP interface.
Syntax:
Use the password-rules command to configure the password (enable or disable).
Table 31 lists the subcommands available with the
password-rules command.
| Command | Function |
|---|---|
| Disable | Disables a password rule. |
| Enable | Enables a password rule. |
| List | Displays the current state of the password rules (enabled or disabled). |
Use the password-rules disable command to disable any or all of the password rules.
Syntax:
Valid values: 0 to 360
Default value: 180
Valid values: any non-numeric character
Default value: none
Valid values: any non-numeric character
Default value: none
Valid values: 1 to 31
Default value: 8
Valid values: 1 to 31
Default value: 8
Use the password-rules enable command to enable any or all of the password rules. See the disable command for a list of password rule descriptions.
Syntax:
Use the password-rules list command to display the current state of the password rules (disabled or enabled).
Syntax:
Use the ppp command to configure AAA for PPP.
Table 32 lists the subcommands available with the ppp
command.
| Command | Function |
|---|---|
| Disable | Disables accounting for PPP. |
| List | Displays the AAA configuration parameters for PPP. |
| Set | Sets the AAA configuration parameters for PPP. |
Use the ppp disable command to disable accounting for PPP.
Syntax:
Use the ppp list command to display the AAA configuration parameters for PPP.
Syntax:
Use the ppp set command to set the AAA configuration parameters for PPP.
Syntax:
Use the servers command to configure individual remote AAA servers.
Table 33 lists the subcommands available with the servers
command.
| Command | Function |
|---|---|
| Add | Adds a remote AAA server profile. |
| Change | Changes a remote server profile. |
| Delete | Deletes a remote server profile. |
| Lists | Displays the AAA server profile information. |
Use the servers add command to add a remote server profile.
Syntax:
Values for the following parameters can be set:
Range: 0 to 10
Default Value: 0
Range: 1 to 10000
Default Value: 1646
Range: 1 to 1000
Default Value: 1645
Valid Values: yes, no
Default Value: yes
Valid Values: yes, no
Default Value: yes
Valid Values: Any alphanumeric character string up to 32 characters long.
Default Value: None.
Valid Values: Any valid IP address
Default Value: 0.0.0.0
Valid Values: 1 to 100
Default Value: 3
Valid Values: 1 to 60
Default Value: 3
Valid Values: Any valid IP address
Default Value: 0.0.0.0
Values for the following parameters can be set:
Valid Values: Any valid IP address
Default Value: 0.0.0.0
Valid Values: 1 to 100
Default Value: 3
Valid Values: 1 to 60
Default Value: 3
Valid Values: Any valid IP address
Default Value: 0.0.0.0
Values for the following parameters can be set:
Valid Values: yes, no
Default Value:
Valid Values: Any 16-hexadecimal digit value
Default Value:
Valid Values: Any valid IP address
Default Value: 0.0.0.0
Valid Values: 0 through 15
Default Value: 0
Valid Values: 0 to 3200
Default Value: 0
Valid Values: 1 to 60
Default Value: 9
Valid Values: Any valid IP address
Default Value: 0.0.0.0
Use the servers change command to change a remote server profile. See the add command for the remote server profile descriptions.
Syntax:
See the servers add command for remote server profile descriptions.
Use the servers delete command to delete a remote server profile. See the add command for the remote server profile descriptions.
Syntax:
See the servers add command for the remote server profile descriptions.
Use the servers list command to display the AAA server profile information.
Syntax:
Use the set command to set the parameters for login, PPP, and L2TP tunnel.
Syntax:
Use the tunnel command to configure AAA for L2TP tunnel.
Table 34 lists the subcommands available with the tunnel
command.
| Command | Function |
|---|---|
| Disable | Disables accounting for L2TP tunnel. |
| List | Displays AAA configuration parameters for L2TP tunnel. |
| Set | Sets the AAA configuration parameters for L2TP tunnel. |
Use the tunnel disable command to disable accounting for L2TP tunnel.
Syntax:
Use the tunnel list command to display the AAA for L2TP tunnel.
Syntax:
Use the tunnel set command to set the AAA configuration parameters for L2TP tunnel.
Syntax:
Use the user-profiles command to access the User
profile config> command prompt. From this prompt, you can access
the following commands.
Table 35. User-profile Configuration Commands
| Command | Function |
|---|---|
| ? (Help) | Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help". |
| Add | Adds a PPP user profile. |
| Change | Changes a PPP user profile. |
| Delete | Deletes a PPP user profile. |
| Disable | Disables a PPP user profile. |
| Enable | Enables a PPP user profile. |
| List | Lists the PPP user profile information. |
| Report | Generates a PPP user profile report. |
| Reset-user | Resets a PPP user profile. |
| Exit | Returns you to the previous command level. See "Exiting a Lower Level Environment". |
Use the user profiles add command to add the user profile of a remote user to the local PPP user data base or to give a tunnel peer access through an IP network to the router.
Syntax:
See Add in the chapter "The CONFIG Process (CONFIG - Talk 6) and Commands" in Access Integration Services Software User's Guide for a description of the command syntax and options.
Example:
Config> add ppp-user
Enter name: [ ]? pppusr01
Password:
Enter again to verify:
Allow inbound access for user? (Yes, No): [yes]
Will user be tunneled? (Yes, No): [No]
Number of days before account expiry[0-1000] [0]? 10
Number of grace logins allowed after an expiry[0-100] [0]? 5
IP address: [0.0.0.0]? 1.1.1.1
Set ECP encryption key for this user? (Yes, No): [No] no
Disable user ? (Yes, No): [No]
PPP user name: pppusr01
User IP address: 1.1.1.1
Virtual Conn: disabled
Encryption: disabled
Status: enabled
Login Attempts: 0
Login Failures: 0
Account expires: Sun 17Feb2036 06:28:16
Account duration: 10 days 00.00.00
Password Expiry: <unlimited>
User 'pppusr01' has been added
Example:
Config> add ppp-user
Enter name: [ ]? tunusr01
Password:
Enter again to verify:
Allow inbound access for user? (Yes, No): [yes]
Will user be tunneled? (Yes, No): [No] yes
Enter hostname to use when connection to this peer: []? host01
Tunnel-Server endpoint address: [0.0.0.0]? 1.1.1.1
PPP user name: tunusr01
Endpoint: 1.1.1.1
Hostname: host01
User 'tunusr01' has been added
See Add in the chapter "Configuring the CONFIG Process" in Access Integration Services Software User's Guide for a description of the command syntax and options.
Example:
Config> add tunnel
Enter name: []? tunnel02
Enter hostname to use when connecting to this peer: []? host02
Set shared secret? (Yes, No): [No]? yes
Shared secret for tunnel authentication:
Enter again to verify:
Tunnel-Server endpoint address: [0.0.0.0]? 2.2.2.22
Tunnel name: tunnel02
Endpoint: 2.2.2.22
Use the change command to change a user-profile.
Syntax:
Use the delete command to delete a user-profile.
Syntax:
Use the disable command to disable a user-profile.
Syntax:
Use the enable command to enable a user-profile.
Syntax:
Use the list command to list user-profile information.
Syntax:
User profile config> list ppp-user
List (Name, Verb, User, Addr, Encr, zdump): [Verb]
PPP user name: ppp01
Expiry: <unlimited>
User IP address: Interface Default
Encryption: Not Enabled
Status: Enabled
Login Attempts: 0
Login Failures: 0
1 record displayed.
Valid values: name, verb, user, addr, encr, zdump
Default value: verb
Use the report command to generate a PPP user profile report.
Syntax:
User profile config> report addresses PPP user name User IP address ----------------- ------------------ ppp01 Interface Default 1 record displayed.
User profile config> report all
PPP user name: ppp01
Expiry: <unlimited>
User IP address: Interface Default
Encryption: Not Enabled
Status: Enabled
Login Attempts: 0
Login Failures: 0
1 record displayed.
User profile config> report callback PPP user name Callback type Phone Number ----------------- ------------------- -------------------- ppp01 1 record displayed.
User profile config> report dump Enter user name: []? user01
User profile config> report encrypt PPP user name Encryption ----------------- --------------- ppp01 Not Enabled 1 record displayed.
User profile config> report name PPP user name ----------------- ppp01 1 record displayed.
User profile config> report password PPP user name Expiry Grace ----------------- ------------ ------ ppp01 <unlimited> 1 record displayed.
User profile config> report time PPP user name Time allotted ----------------- ------------------- ppp01 1 record displayed.
User profile config> report user
Enter user name: []? login01
PPP user name: login01
Expiry: <unlimited>
User IP address: Interface Default
Encryption: Not Enabled
Use the reset-user command to reset a user-profile.
Syntax:
This section describes dynamic reconfiguration (DR) as it affects Talk 6 and Talk 5 commands.
AAA does not support the CONFIG (Talk 6) delete interface command.
AAA does not support the GWCON (Talk 5) activate interface command.
AAA does not support the GWCON (Talk 5) reset interface command.
AAA supports the following CONFIG commands that immediately change the
operational state of the device. These changes are saved and are
preserved if the device is reloaded, restarted, or you execute a dynamically
reconfigurable command.
| Commands | ||
| CONFIG, add ppp-user | ||
| CONFIG, feature authentication, enable login-last-resort | ||
CONFIG, feature authentication, disable login-last-resort
| ||
| CONFIG, feature authentication, enable tech-support-bypass | ||
CONFIG, feature authentication, disable tech-support-bypass
| ||
| CONFIG, feature authentication, enable unauthent-accounting | ||
| CONFIG, feature authentication, disable unauthent-accounting |
The following table describes the AAA configuration commands that
cannot be dynamically changed. To activate these commands, you need to
reload or restart the device.
| Commands |
| CONFIG, feature authentication, server add |
| CONFIG, feature authentication, server change |
| CONFIG, feature authentication, server delete |
| CONFIG, feature authentication, enable ipsec-accounting |
| CONFIG, feature authentication, disable ipsec-accounting |
| CONFIG, feature authentication, ppp set |
| CONFIG, feature authentication, tunnel set |
| CONFIG, feature authentication, login set |
| CONFIG, feature authentication, set accounting options |
| CONFIG, feature authentication, password-rules enable |
| CONFIG, feature authentication, password-rules disable |