topic Local Username Database in Network Access Control

Local Username Database

shahab.66 — Mon, 11 Mar 2019 06:19:26 GMT

Dear Friends,

I'm struggling with an issue.

I've set up an ssl vpn (Anyconnect) on a cisco 2811 router. Because of certain limitations I can't setup a radius or tacacs server.

my VTY line authentication is aaa login local

I have some questions:

1- can I set up accounts on the local database that can't login to the router (just be able to use the VPN)

2- can I create an aaa authentication list that contain just some of the local usernames not all of them so I can limit the logins

3- can I assign an access-list to a specific username? (username **** access-class ) didn't work for me when the user connects the anyconnect client! (WebVPN ACL applies)

Please help me I'm struggling!!!

Hello,1. As far as I know you

Milos Megis — Tue, 15 Dec 2015 08:11:07 GMT

Hello,
1. As far as I know you can only specify for VPN user privilege level 0 so user then can connect to router but will have only "enable" command and without enable password he can do nothing.

I don´t know to answer on 2. and 3. question. But I think that you can have only one local database with usernames and also you cannot assign access list to username.

Thanks for the help,

shahab.66 — Sun, 20 Dec 2015 20:36:03 GMT

Thanks for the help,

I Finally did it, using aaa attribute lists I set policies to user groups and my problem is solved!

Can you give a code snippet,

Carsten Peukert — Mon, 30 May 2016 22:04:50 GMT

Can you give a code snippet, how do you have configured the aaa attribute list and the policies to user groups?

Thanks