|
|
|
Authentication can be done locally by the CNA system itself, or by a RADIUS or TACACS+ server.
You can specify the authentication methods with the aaa authentication login CLI command. Specify RADIUS servers with the radius-server host command. Specify TACACS+ servers with the tacacs-server host command. You can use these commands multiple times to specify more than one server of either type.
If you want to use both RADIUS and TACACS+, the device will attempt the methods in the order specified.
If you specified RADIUS as the first method, for example, the CNA system will attempt to authenticate a login request through each of the RADIUS servers that you have identified with the radius-server host command.
If none of these servers are able to authenticate the user, the CNA system will attempt to authenticate using the servers specified for the second method.
If that fails, or you have not specified a choice in the configuration, the device will try local authentication. If that fails, the user attempting to log on will be denied access.
|
|
|