Cisco CRS User Manual page 27
Ios xr system security command reference
Hide thumbs
Also See for CRS:
- Configuration manual (430 pages) ,
- Command reference manual (155 pages) ,
- Manual (50 pages)
Table of Contents
Advertisement
Authentication, Authorization, and Accounting Commands
Command History
Release
Release 2.0
Release 3.6.0
Usage Guidelines
Use the aaa authorization command to create method lists defining specific authorization methods that can
be used on a per-line or per-interface basis. You can specify up to four methods in the method list.
Note
The command authorization mentioned here applies to the one performed by an external AAA server and
not for task-based authorization.
Method lists for authorization define the ways authorization will be performed and the sequence in which
these methods will be performed. A method list is a named list describing the authorization methods (such as
TACACS+), in sequence. Method lists enable you to designate one or more security protocols for authorization,
thus ensuring a backup system in case the initial method fails. Cisco IOS XR software uses the first method
listed to authorize users for specific network services; if that method fails to respond, Cisco IOS XR software
selects the next method listed in the method list. This process continues until there is successful communication
with a listed authorization method or until all methods defined have been exhausted.
Note
Cisco IOS XR software attempts authorization with the next listed method only when there is no response
(not a failure) from the previous method. If authorization fails at any point in this cycle—meaning that
the security server or local username database responds by denying the user services—the authorization
process stops and no other authorization methods are attempted.
The Cisco IOS XR software supports the following methods for authorization:
• none—The router does not request authorization information; authorization is not performed over this
• local—Use the local database for authorization.
• group tacacs+—Use the list of all configured TACACS+ servers for authorization.
• group radius—Use the list of all configured RADIUS servers for authorization.
• group group-name—Uses a named subset of TACACS+ or RADIUS servers for authorization.
Method lists are specific to the type of authorization being requested. Cisco IOS XR software supports four
types of AAA authorization:
• Commands authorization—Applies to the EXEC mode commands a user issues. Command
OL-24740-01
line or interface.
authorization attempts authorization for all EXEC mode commands.
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
Modification
This command was introduced.
The eventmanager keyword (fault manager) was added.
aaa authorization
17
Advertisement
Table of Contents
