topic LDAP and SSH/Console access in Network Access Control

LDAP and SSH/Console access

hjacquemin — Thu, 19 Mar 2020 12:02:09 GMT

Hello everyone,

I'm looking for example to configure LDAP authentication for SSH/Console connection on swithes for the admin group.

I read some topics where some say it's not possible and other it's possible.

I have the following set of devices:

Cat 3750

Cat 3750X

Cat 9200/9300

Is that possible for such devices? Can you give examples ?

Regards

Re: LDAP and SSH/Console access

Seb Rupik — Thu, 19 Mar 2020 12:32:05 GMT

Hi there,

Take a look at freeRADIUS to handle the AAA requests:

https://wiki.freeradius.org/vendor/Cisco

...then configure LDAP as the identity datastore to verify users against:

https://wiki.freeradius.org/modules/Rlm_ldap

cheers,

Seb

Re: LDAP and SSH/Console access

Cristian Matei — Thu, 19 Mar 2020 16:21:12 GMT

Hi,

Most Cisco switches, especially access/distribution level, never had support for LDAP, especially LDAP being used for login access to the router. Your best bet is to use TACACS+ or RADIUS, there are free versions for these, and you can integrate RADIUS/TACACS+ with LDAP. Using TACACS+ vs RADIUS for admin access, it's a matter of if you want command authorization and command accounting or not, as these two features are only supported via TACACS.

FREE RADIUS and FREE TACACS that can integrate with LDAP.

Regards,

Cristian Matei.