Restricting User Access
Users who are authenticated via RADIUS or TACACS+ can be restricted to certain sets of commands and virtual routers (VRs). The levels of access are shown in Table 6-2.
Restricting Access to Commands with RADIUS
You can use RADIUS authentication to specify a level of commands that a user is allowed. If you do not configure RADIUS authentication for the console or virtual terminals, all users who successfully log in are automatically granted Level 1 access.
The vendor-specific attribute (VSA) admin-auth-level supports the levels of access shown in Table 6-2. In addition to VSA access level support, the software provides access to levels 1 and 10 through the initial-auth-level in the standard RADIUS service-type attribute. If the RADIUS service-type attribute is included in the RADIUS access-accept message, the standard attribute overrides any VSA setting.
If you are using the RADIUS service-type attribute to assign access levels, the system sets the initial-auth-level as follows:
- If the service-type attribute is set to "administrative," then the initial-auth-level is set to 10.
- If the service-type attribute is set to "nas prompt" or "login," the initial-auth-level is set to 1.
Per-User Enable Authentication
Once a user is authenticated through RADIUS, the RADIUS server provides the ERX system with the names of the privilege levels (for example, "10") that the user has enable access to. When the user attempts to access a privilege level through the enable command, the system either denies or approves the user's request. The decision to deny or approve the user's request is based on the list the system received through RADIUS. See Table 6-3.
|
The user is not prompted for a password, since the system knows whether or not the user should have access to the requested level. If the user is not authenticated through RADIUS, the system uses the system-wide enable passwords instead.
Restricting Access to Virtual Routers
You can use RADIUS authentication to specify whether users can access all virtual routers (VRs), one specific VR, or a set of specific VRs.
|
The VSA Juniper-Allow-All-VR-access controls access; the VSA Juniper-Virtual-Router controls the VR to which the user logs in, and the VSA Juniper-Alt-CLI-Virtual-Router-Name specifies which VRs other than the VR specified by the VSA Juniper-virtual-router are accessible to restricted users. See Table 6-4.
VSA Configuration Examples
Consider a system on which five VRs have been configured. The VRs are called Boston, Chicago, Detroit, Los Angeles, and San Francisco. The following examples illustrate how to use the VSAs to control a user's access to these VRs.
Example 1
In this example, you want the user to have access to all VRs and to log in to the default VR. Accept the default setting or set the following VSA:
Example 2
In this example, you want the user to have access to all VRs and to log in to the VR Boston. Set the VSAs as follows:
Example 3
In this example, you want the user to have access only to the VR Boston. Set the VSAs as follows:
Example 4
In this example, you want the user to log in to VR Boston, and to have access to VRs Chicago, Los Angeles, and San Francisco. Set the VSAs as follows:
- Juniper-Allow-All-VR-Access - 0
- Juniper-Virtual-Router - Boston
- Juniper-Alt-CLI-Virtual-Router-Name - Chicago
- Juniper-Alt-CLI-Virtual-Router-Name - Los Angeles
- Juniper-Alt-CLI-Virtual-Router-Name- San Francisco
Commands Available to Users
If you do not configure RADIUS authentication for the console or virtual terminals, there are no restrictions on VR access for any user who successfully logs onto the system. For example, nonrestricted users can
- Issue the virtual-router command in Privileged Exec mode, to switch to another previously created virtual router.
- Issue the virtual-router command in Global Configuration mode to create a new virtual router and switch to its context.
- Access Global Configuration mode to configure the system and virtual routers.
- View all settings for the system and all virtual routers.
User restricted to one or a set of specific VRs can see and use only a limited set of commands to monitor the status of those VRs and view some configuration settings on those VRs. More specifically, such users
- Can issue the virtual-router command in Privileged Exec mode to switch to another previously configured VR to which they have access.
- Cannot create new VRs or access VRs other than those to which they have access.
- Cannot access Global Configuration mode and cannot configure VRs to which they have access.
- Cannot see or use any commands associated with the file system, boot settings, or system configuration.
Table 6-5 lists some, but not all, commands accessed from User Exec or Privileged Exec mode that are available only to users with no VR restriction.