topic Re: help£¡ in Network Access Control

help£¡

zhang-hao — Sun, 10 Mar 2019 14:23:40 GMT

i need add some branch routers as clients to the acs server. so when choosing the ip addresses of these routers, which interface's ip address should i choose?

if i use these routers' loopback interface ip address, should i add any other command beside the basic aaa configurations? I mean to specify the loop back address as the source to send related aaa info to the acs server?

Thanks in advance!

Re: help£¡

ywadhavk — Mon, 07 Jul 2003 14:35:49 GMT

Hi,

You should try using that interface address that is closest to the ACS server's segment. But you could source the Radius/Tacacs from other interfaces such as the loopback as well.

The command to use is

ip radius source-interface

or in case of tacacs,

ip tacacs source-interface

Thanks,

yatin

Re: help£¡

zhang-hao — Tue, 08 Jul 2003 00:33:16 GMT

Hi! Thanks a lot for your help! And could you tell me any links to learn these commands?

And more help is needed, if each branch router has a isdn backup for the main ddn circuit to the center router, in order to authenticate the user of isdn in case the failure of main circuit, how can i add users in the acs server? I mean if it is same as i do when i add users for telnet and enable authentication.

The following command for isdn authentication I configured on the center router:

aaa new-model

aa authentication ppp default group tacacs+

tacacs-server host x.x.x.x key xxxxxxx

And users for isdn have been defined in the branch routers.

So will the above configuration enough for the isdn authentication to take effect?

Thanks in advance!