Comments on: Authenticating to Cisco IOS via Active Directory http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/ The weblog of an IT pro specializing in virtualization, storage, and servers Fri, 12 Mar 2010 03:22:54 +0000 http://wordpress.org/?v=abc hourly 1 By: Eric http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/comment-page-1/#comment-47189 Eric Wed, 30 Dec 2009 15:41:19 +0000 http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/#comment-47189 If you are using the Enterprise or Data Center versions of IAS, you can use network masks when setting up the Client configs. Way better than adding thousands of individual entries! More info here: http://www.pskl.us/wp/?p=312 If you are using the Enterprise or Data Center versions of IAS, you can use network masks when setting up the Client configs. Way better than adding thousands of individual entries!

More info here: http://www.pskl.us/wp/?p=312

]]> By: skribbla http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/comment-page-1/#comment-46277 skribbla Wed, 21 Oct 2009 10:18:53 +0000 http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/#comment-46277 umm arent u supposed to then apply the authentication list to a line (console/tty/vty). like go into line config mode and apply the auth list to a line or set of lnes?? because it seems we created the auth method but ddnt apply it anywhere...... or i could be wrong :-) umm arent u supposed to then apply the authentication list to a line (console/tty/vty). like go into line config mode and apply the auth list to a line or set of lnes?? because it seems we created the auth method but ddnt apply it anywhere…… or i could be wrong :-)

]]> By: Russell http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/comment-page-1/#comment-40076 Russell Wed, 16 Jul 2008 20:10:40 +0000 http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/#comment-40076 Thanks Scott and Keith, With the help you guys gave here I was able to get all of our equipment using AD for primary authentication. This really helped when an employee found out he was being fired and tried to kill all the Cisco devices. We had lowered his privilege via AD while he was in with HR and saved ourselves who know how much. I couldn't have ever connected to all the switches and routers fast enough to guarantee their security without this little gem. THANKS A TON!! --Russell Thanks Scott and Keith,

With the help you guys gave here I was able to get all of our equipment using AD for primary authentication.

This really helped when an employee found out he was being fired and tried to kill all the Cisco devices. We had lowered his privilege via AD while he was in with HR and saved ourselves who know how much. I couldn’t have ever connected to all the switches and routers fast enough to guarantee their security without this little gem.

THANKS A TON!!

–Russell

]]> By: Keith http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/comment-page-1/#comment-37788 Keith Tue, 13 May 2008 01:52:05 +0000 http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/#comment-37788 Yes it is possible to authenticate directly to a privileged level via IAS (or NAP if using Windows 2k8). In your IAS/NAP Network Policy you need to add the vendor specific RADIUS attribute Cisco-AV-Pair. The syntax should be "shell:priv-lvl=15". You can also change 15 to any other level from 1 - 15. Second you need to add the following command to the swithch/router. aaa authorization exec default group radius local Yes it is possible to authenticate directly to a privileged level via IAS (or NAP if using Windows 2k8).

In your IAS/NAP Network Policy you need to add the vendor specific RADIUS attribute Cisco-AV-Pair. The syntax should be “shell:priv-lvl=15″. You can also change 15 to any other level from 1 - 15.

Second you need to add the following command to the swithch/router.

aaa authorization exec default group radius local

]]> By: slowe http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/comment-page-1/#comment-33992 slowe Fri, 02 Nov 2007 00:35:14 +0000 http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/#comment-33992 Will, It probably can be done, but I don't know how. Sorry! Will,

It probably can be done, but I don’t know how. Sorry!

]]> By: will http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/comment-page-1/#comment-33946 will Tue, 30 Oct 2007 14:15:41 +0000 http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/#comment-33946 Scott, I was readin about your authorizing to a switch using a RADIUS server. my question is this: is there a way to authenticate to the switch directly to exec privilege using the radius server without being challenged by the switch for a local password? thanks, Will Scott,

I was readin about your authorizing to a switch using a RADIUS server. my question is this: is there a way to authenticate to the switch directly to exec privilege using the radius server without being challenged by the switch for a local password?

thanks,
Will

]]> By: slowe http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/comment-page-1/#comment-32619 slowe Wed, 04 Jul 2007 11:15:16 +0000 http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/#comment-32619 Good question! This approach provides only plain jane authentication--no command tracking or auditing. Good question! This approach provides only plain jane authentication–no command tracking or auditing.

]]> By: Charles http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/comment-page-1/#comment-32616 Charles Wed, 04 Jul 2007 03:31:17 +0000 http://blog.scottlowe.org/2007/07/02/authenticating-to-cisco-ios-via-active-directory/#comment-32616 Would this method also give the command tracking and auditing that TACACS would give you? Or just plain Jane authentication. Would this method also give the command tracking and auditing that TACACS would give you? Or just plain Jane authentication.

]]>