The goal of TACACS+ is to provide a method for managing multiple network access points from a single management service. Your switch can be a network access server along with other Cisco routers and access servers. A network access server provides connections to a single user, to a network or subnetwork, and to interconnected networks.
Sample configuration using TACACS+ instead of RADIUS:
You can apply router ACLs on switch virtual interfaces (SVIs), which are Layer 3 interfaces to VLANs; on physical Layer 3 interfaces; and on Layer 3 EtherChannel interfaces. Router ACLs are applied on interfaces for specific directions (inbound or outbound). You can apply one IP access list in each direction. Router ACL抯 are identical to the ACL抯 you configured on a Router. You have the option of standard and extended IP ACL抯. On a side note you can not configure Dynamic or Reflexive ACL抯 on the 3550.
Examples of Standard and Extended Access Lists:
Switch(config)# access-list 2 permit 36.48.0.3 Switch(config)# access-list 2 deny 36.48.0.0 0.0.255.255 Switch(config)# access-list 2 permit 36.0.0.0 0.255.255.255 Switch(config)# interface gigabitethernet0/1 Switch(config-if)# ip access-group 2 in Switch(config)# access-list 102 permit tcp any host 128.88.1.2 eq 25 Switch(config)# access-list 102 permit icmp any any Switch(config)# interface gigabitethernet0/1 Switch(config-if)# ip access-group 102 in
You can also create Named ACL抯 as well as Time-based ACL抯
VLAN Maps
VLAN maps can access-control all traffic. You can apply VLAN maps on the switch to all packets that are routed into or out of a VLAN or are bridged within a VLAN. VLAN maps are used strictly for security packet filtering. Unlike router ACLs, VLAN maps are not defined by direction (input or output). You can configure VLAN maps to match Layer 3addresses for IP traffic. All non-IP protocols are access-controlled through MAC addresses and Ethertype using MAC VLAN maps. (IP traffic is not access controlled by MAC VLAN maps.) You can enforce VLAN maps only on packets going through the switch; you cannot enforce VLAN maps on traffic between hosts on a hub or on another switch connected to this switch. With VLAN maps, forwarding of packets is permitted or denied, based on the action specified in the map.
精品推荐