Lock-and-Key Access

[alain.desnoyers]

I tried configuring Lock-and-Key access on the RSM of a Catalyst switch with the following commands

username alain password alain

access-list 120 dynamic test timeout 5 permit ip any any

access-list 120 permit tcp any host 172.20.52.33 eq telnet

interface vlan20

ip access-group 120 in

The access-list looks fine just like the example I referred to

When I telnet into the router, instead of getting a username and password prompt, I still get the normal prompt before I started this (password prompt).

I only when I issue the login command do I get the username /password prompt.

What am I missing?

And also, I am not sure how I can have users use different dynamic access-lists based on individual user profiles.

[p.krane]

This might help: http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113ed_cr/secur_c/scprt3/sclock.htm and http://www.cisco.com/warp/public/cc/pd/iosw/ioft/iolk/tech/landk_wp.htm

[fujin.huang]

You need to define the user alain to use the dynamic access-list:

username alain autocommand access-enable timeout 5

For the second question, I'm also trying that, but seems not able to do that, Anyone got any idea on this?

[mbellears]

The following will give you the login prompt:

line vty 0 4

login local

autocommand access-enable host timeout 2

Then you can have as many:

username user password pass

As you need.

R.E Your second question - Try this: have loopback interfaces with unique live IP's and then assign the different ACL's to them....Entirely up to you who you give each IP to - Not a very elegant method (May not work as it is untested!)

Other than the above - I'm not sure it can be done (Maybe with a radius/tacacs server it could be achieved?)

HTH,

MB

[pmoulay]

you are missing the following command:

under line vty 0 4

login local ; you are using the local database

;you can also specify tacacs+ for

;authentication

also, as a precaution or it will not work

add in your access-list the following statement:

access-l 101 permit tcp any any established