Authentication, Authorisation and Accounting

Introduction

Authentication, Authorisation and Accounting (AAA) is an umbrella term referring to protocols and methods that can be used to handle and verify user access.

The three individual terms refer to who is allowed to access what device (Authentication), if access is granted what are the limitations of their available actions (authorisation), and to recount what actions they performed (accounting).

For some use-cases utilising the systems AAA options, refer to the following:

• Built-in Accounts
• Local Databases HowTo
• Remote Servers HowTo

The SSL security level is configured globally under /config/system/ssl-security-level, since it applies to the system's LDAP connection rather than to an individual remote-server entry. See System Settings.

Overview

AAA in the system is separated into two different parts that are combined together. Firstly the system allows for setting up different types of AAA methods. Afterwards, the configured AAA method can be bound to various services in the system that have support for AAA methods. The best example of this is the login service.

Authentication Chain

An authentication chain is a configurable sequence of authentication methods that the system uses to verify user credentials during login attempts. Each method in the chain is evaluated in order, and the process continues until a method successfully authenticates the user or all methods have been exhausted. The chain can include remote servers, server groups, and built-in accounts, with options to control behaviour on authentication rejection and fallback to local accounts. This approach provides flexibility and redundancy, ensuring reliable access control even if some authentication sources are unavailable. Below is an example of an authentication chain that includes two remote servers, a server group, and the built-in accounts as fallback. The chain is configured to try the next method on rejection and to fallback to local accounts if all methods are unavailable.

+-----------------+     +-----------------+     +----------------+     +-------------------+
| Remote Server 0 | --> | Remote Server 1 | --> | Server Group 0 | --> | Built-in Accounts |
+-----------------+     +-----------------+     +----------------+     +-------------------+
		 |              		 |                      |
		 v              		 v                      v
 [on-reject: next]       [on-reject: next]    [local-fallback: always]

Figure 1: Example AAA authentication chain showing Remote Server, Server Group, and Built-in Accounts with fallback and reject handling.

Authentication Methods

The AAA framework in the system have support for a number of different AAA methods that are presented below:

• Built-in Accounts: The only account present in a factory default system. As an example, the admin user is one such an account. Built-in accounts allow for defining per account authorisation levels. For more information see Built-in Accounts HowTo. The built-in login methods are implicit and are always last in the authentication chain. For more info see local-fallback.

• Remote Servers: Centralized authentication on remote servers via RADIUS, TACACS+, and LDAP. For additional information see Remote Servers HowTo. NOTE: The device can be configured to use multiple remote servers, but none will be used unless they are added to the authentication chain. Only one LDAP server entry can be added to the chain, but it can have a primary address and an optional secondary address for a redundant failover server. LDAP credentials are cached during login and hence allows login using cached credentials. The cache is removed at reboot.

• Server Groups: Allows grouping of multiple remote servers for authentication. This can be useful for load balancing and failover scenarios. For additional information see Remote Servers HowTo.

• Local Database (Deprecated): Allows storing of credentials locally on the device, with no need for any external infrastructure.

  This functionality is considered deprecated and no longer supported for newly configured systems. Existing configurations will continue to work. For more information see Local Databases HowTo.

Services

The system currently supports AAA methods to be used for the following services:

Service	Remote Server	Local Database	Built-in Accounts
Login	X		X
OpenVPN	X	X

OpenVPN

The systems AAA methods can be used to authenticate OpenVPN clients. The OpenVPN client will authenticate itself using a certificate, and optionally also via username and password. When using this option, a system acting as an OpenVPN Server, can either use a local database or a central server (or server group) to verify the client’s username and password.

For an example of how this can be done refer to this HowTo:

• OpenVPN Host to LAN

Authorisation levels

A user should be granted the least possible privilege that allows performing that user’s task. This is realised by a light-weight Role Base Access Control (RBAC) that is available for built-in accounts.

Modules

The functionality available to the users is split into multiple areas called RBAC modules. For CLI, each command will belong to one of these modules. The RBAC modules are:

• Device status for accessing the status of the device (show commands will mostly go here).

• Audit trail for accessing the audit log functionality.

• PKI for accessing Public Key Infrastructure functionality.

• AAA for accessing Authentication, Authorisation, and Accounting functionality.

• Device config for accessing device configuration context.

• Utils/tools for accessing utilities and tools (like ping, ssh, telnet etc).

• Maintenance for accessing maintenance tools (like copy, export, diff etc).

• Firmware management for accessing firmware management.

• Factory reset for performing factory reset operation.

• Shell access for accessing the Linux shell.

Permissions

For each RBAC module, the following permissions are defined:

Permission	Acronym	Definition
view	v	View on screen
read	r	Download reports where available
write	w	Update data
executing	e	Execute a command
update	u	Change firmware
shell	X	Enter Linux shell

Roles

Currently six roles are available:

Role	Description	Responsibility
Administrator	Full access to all device functions and configurations	Configure security policies Manage users and roles Perform device configuration Manage firmware upgrades Manage backup and restore
Engineer	Permission to configure most functionality except security features like AAA, PKI and audit logs	Identify and solve complex functional issues Perform device configuration Manage firmware upgrades Manage backup and restore
Operator	Limited access to operational tasks, such as monitoring and basic configuration changes	Identify and solve functional issues Perform device control actions Manage firmware upgrades
Auditor	Restricted access, primarily read-only, for viewing audit logs	Monitor audit-log to identify potential security issues
Viewer	Restricted access, primarily read-only, for monitoring	Identify and solve simple functional issues
Guest	Deprecated: Replaced by Viewer. Has read-only access to a restricted CLI	Identify and solve simple functional issues

Built-in accounts and LDAP remote server can have multiple roles.

Role	LDAP	RADIUS	TACACS+	Local Database	Built-in Accounts
Administrator	X	X	X	X	X
Guest	X				X
Viewer	X				X
Operator	X				X
Engineer	X				X
Auditor	X				X

Roles and Permissions per Module

Each role will have a set of permissions on each RBAC module according to the following table:

Module	Administrator	Guest	Viewer	Operator	Engineer	Auditor
Device status	vr	v	v	vr	vr	v
Audit trail	vrwe	-	-	vr	vr	vr
PKI	vrwe	v	v	vr	v	vr
AAA	vrwe	v	v	vr	vr	vr
Device config	vrwe	-	-	vr	vrwe	-
Utils/tools	vrwe	-	-	vre	vrwe	-
Maintenance	vrwe	-	-	vre	vrwe	-
Firmware management	vrweu	-	-	vrweu	vrweu	-
Factory reset	vrwe	-	-	-	-	-
Shell access	Xvw	-	-	-	-	-

Configuration

The AAA configuration consists of a number of different areas spread over a number of different context levels.

General Settings

The AAA can be configured from the configuration context in the CLI. This context contains the overall AAA configuration and access to all other AAA sub-contexts.

example:/#> configure
example:/config/#> aaa
example:/config/aaa/#>

Syntax

[no] user USERNAME

Description

Create and mange a built-in account.

Options

Option	Description
USERNAME	Name of a new or already existing built-in user account
no	Removes specified user

username NAME [password | hash] PASSWORD

Description

Set the password for specific allowed users, like the admin user.

warning

DEPRECATED: use user admin to enter user-admin context and password from within that context.

Options

Option	Description
NAME	The user to change the password for.
PASSWORD	Password with the following allowed characters: ASCII 33-126 (octal 041-176), max length 64 chars.

[no] password-policy

Description

Set password policy. For details read here.

[no] lockout-policy

Description

The lockout policy is a security feature that prevents unauthorized access to the system by locking out users who enter incorrect login credentials too many times. You can activate and configure the lockout policy in this sub-context.

Options

Option	Description
enable	Enable/disable account lockouts
deny	Number of consecutive authentication failures until lockout of the user. Default number is 3 times. Allowed values are 3 - 10 times.
deny-admin	If this option is selected even the built-in admin ackount can be locked out. Default is yes (enabled).
unlock-time	Duration of the lockout (s). Default is 600 seconds (10 minutes). Allowed values are 10 - 1800 seconds.
[no] exclude <console>	Always allow logins over the selected interface. Currently only console is selectable.

note

Lockout only happens if deny number of failed login attempts happens within 900 seconds. This value is currently hard-coded and not configurable.

note

You can view the locked out users with the command show lockout in the admin-exec context and unlock a locked out user with the command lockout <username> reset in the same context.

[no] auth-chain

Description

Manage the authentication chain.

note

Enters a sub-configuration context.

Options

Option	Description
no	Reset the authentication chain to defaults.

[no] local-db ID [plain]

Description

Create and manage local databases. Default type is 'hash' but the keyword 'plain' can be used to create a database that contains plain text passwords. The type can only be defined once when the local database is created, therefore the keyword is not available in the sub-configuration context.

note

Enters a sub-configuration context.

Options

Option	Description
no	Remove a specific local database if an ID is provided, otherwise remove all local databases.
ID	Id in the range 0-4, any other id will be invalid.

[no] remote-server ID [type <radius | tacacs | ldap>]

Description

Create and manage remote authentication servers.

note

Enters a sub-configuration context.

Options

Option	Description
no	Remove a specific remote server if an ID is provided, otherwise remove all servers.
ID	Id in the range 0-5, any other id will be invalid.
type	The type of remote server to create: radius, tacacs, or ldap. This setting can still be changed in the server configuration. Only one LDAP server entry can be added to the chain, but it can have a primary address and an optional secondary address for a failover server.
encryption-type / connection-security	The encryption type (RADIUS/TACACS) or connection security (LDAP) of the remote server. Available options depend on server type. For radius: none, peap-mschapv2. For tacacs: none. For ldap: none, ldaps, ldap-starttls.

[no] server-group ID [type <radius | tacacs>]

Description

Create and manage server groups.

note

Enters a sub-configuration context.

Options

Option	Description
no	Remove a specific server group if an ID is provided, otherwise remove all server groups.
ID	Id in the range 0-1, any other id will be invalid.
type	The type of server group to create, either radius or tacacs. This setting can still be changed in the server group configuration.

[no] mac-auth ID

Description

Manage a MAC authentication group.

note

Enters a sub-configuration context.

Options

Option	Description
no	Remove a specific MAC authentication group if an ID is provided, otherwise remove all MAC authentication groups.
ID	Id in the range 0-99.

Built-in Account Settings

This section describes configuration of built-in accounts. Up to 16 built-in accounts are allowed. Only built-in accounts can have guest / operator / auditor roles. An example of a built-in account that is always present in factory configured system is admin.

example:/config/aaa/#> user admin
example:/config/aaa/user-admin/#>

[no] enable

Description

Enable or disable this user in the system. A user cannot disable themselves.

note

SSH Authorised Keys of a disabled user are removed and must be imported again upon enabling the user.

[no] password [expire] [alg ALG] secret PASSWORD

Description

Set password in clear text and hash it using given algorithm.

Options

Option	Description
expire	Expire password, forcing user to change it at next login.
ALG	md5, sha256 or sha512. By default md5crypt (md5) is used if no algorithm is given. If the password-policy option is set the password must meet the policy.
PASSWORD	Password with the following allowed characters: ASCII 33-126 (octal 041-176), max length 64 chars.
no	Disable password for the user. When issuing 'no password' command password-based authentication is disabled, making it impossible to log in using a username and password. However, if SSH keys exist, you can still log in using them. note Please exercise caution when using 'no password', as it could potentially lock you out from the device if no other administrator accounts exist and no SSH keys are defined.

[no] hash HASH-STRING

Description

Set the user password in hash format.

note

When the password-policy option is enabled this option is disabled (See here).

Options

Option	Description
HASH-STRING	An arbitrary hash-string. It should be used with caution. A cryptographically weak hash-string will compromise the system's security.
no	disable password for the user

[no] role viewer | guest | operator | administrator | engineer | auditor

Description

Set role of the user. Default role is viewer. There must be at least one administrator in the system.

Options

Option	Description
administrator	Has all privileges in the system.
viewer	Has permissions to view objects with-in the device and read values where applicable. [Default]
guest	Has only access to a restricted interface with limited read-only functionality. Deprecated, replaced by viewer.
operator	Has permissions to read and view objects and values with-in the device and where applicable perform control actions (e.g. reboot) and update firmware.
auditor	Can read audit logs and other audit relevant information.
engineer	Can perform most of the configuration, except security related parts like AAA, PKI, audit logs.

[no] ssh-user-key import

Description

SSH user key management

Options

Option	Description
import	Import authorised public keys. Enter an interactive mode for pasting user's authorised public keys. One key per line, each key having format as used in OpenSSH i.e.: <type-name> <base64-encoded-ssh-public-key> [comment] Example: ssh-rsa AAAAB3NzaC...G6KCGOnv user@host Notes: This command overwrites any existing keys. Imported key(s) are not checked for validity.
no	Removes imported keys.

Examples:

For examples on how to create and manage built-in accounts see Built-in Accounts

Local Database Settings

Configure a local database and enter its configuration context. When creating a local database the ID must be a number from 0 to 4.

warning

This functionality is considered deprecated and no longer supported for newly configured systems. Existing configurations will continue to work.

example:/config/aaa/#> local-db 0
Creating new local db 0
example:/config/aaa/local-db-0/#>

Syntax

[no] username NAME [password | hash] PASSWORD

Description

Add a user to this local database.

Options

Option	Description
no	Remove a specific user based on the provided NAME.
NAME	The user to change the password for.
PASSWORD	Password with the following allowed characters: ASCII 33-126 (octal 041-176), max length 64 chars.

[no] description STRING

Description

Free form description of this local database.

Options

Option	Description
no	Remove any description.
STRING	Free form text with a maximum length of 15 characters.

Remote Server Settings

Configure a remote server and enter its configuration context. When creating a remote server the ID must be a number from 0 to 5.

note

To use a remote server for authentication it must be added to the authentication chain.

example:/config/aaa/#> remote-server 0
Creating new remote server 0
example:/config/aaa/remote-server-0/#>

Syntax

[no] type <radius | tacacs | ldap>

Description

Set the remote server type to be radius, tacacs, or ldap.

Options

Option	Description
no	Reset the type to its default setting, radius.

note

Only one LDAP server entry can be added to the chain, but it can have a primary address and an optional secondary address for a failover server.

[no] encryption-type <none | peap-mschapv2>

Description

Set the encryption type for RADIUS/TACACS remote servers.

For radius: none (default), peap-mschapv2.

For tacacs: none (default).

[no] connection-security <none | ldaps | ldap-starttls>

Description

Set the connection security for LDAP remote servers.

For ldap: none (default), ldaps (LDAP over SSL/TLS, default port 636), ldap-starttls (LDAP with STARTTLS upgrade, default port 389).

warning

Using none for ldap will transmit all data — including user passwords — in plain text over the network. Use ldaps or ldap-starttls in production environments.

Options

Option	Description
no	Reset to the default encryption type (none).

[no] description STRING

Description

Free form description of this remote server.

Options

Option	Description
no	Remove any description.
STRING	Free form text with a maximum length of 15 characters.

[no] address <IP | FQDN>

Description

Address of the remote server. Not available for ldap type; use primary-address instead.

Options

Option	Description
no	Remove and configured address.
IP	IP address in standard quad-dotted notation, e.g. 192.168.1.1.
FQDN	A fully qualified domain name.

[no] password PASSWORD

Description

Password for remote server. For ldap type use bind-password instead.

note

May not be empty.

Options

Option	Description
no	Remove the current configured password.
PASSWORD	Password with the following allowed characters: ASCII 33-126 (octal 041-176), max length 64 chars.

[no] auth-port PORT

Description

Authentication port to connect to on remote server.

Options

Option	Description
no	Use the default port for the selected type of server. For radius it is 1812, for tacacs it is 49, and for ldap it is 389 (or 636 when using ldaps encryption).
PORT	The port number to use.

[no] timeout SECONDS

Description

Abort trying to connect to the server after a timeout. Default is 5 seconds. Valid range is 3 to 60 seconds.

Options

Option	Description
no	Reset to the default timeout (5 seconds).
SECONDS	Timeout in seconds.

[no] ca-cert STRING

Description

Public CA certificate label used to validate the remote server. Available for radius with peap-mschapv2 or eap-tls encryption, and for ldap with ldaps or ldap-starttls encryption.

Important

When using a certificate, the certificate SAN must contain the primary/secondary address that is configured.

Options

Option	Description
no	Remove the configured CA certificate.
STRING	Label of a CA certificate imported into the PKI store.

[no] client-cert STRING

Description

Client certificate label for TLS authentication. Available for radius with eap-tls encryption, and for ldap with ldaps or ldap-starttls encryption.

Options

Option	Description
no	Remove the configured client certificate.
STRING	Label of a client certificate (P12/PFX package) imported into the PKI store.

LDAP-specific Settings

The following settings are only available when the server type is ldap.

[no] ciphers-tls1.2 <CIPHER[,CIPHER ...]>

Description

List of TLS 1.2 cipher suites (at selected security level) to include in cipher negotiation between clients and servers.

Options

Option	Description
no	Disables TLS1.2
no <CIPHER[,CIPHER ...]>	Removes the specified cipher suite from list.
CIPHER[,CIPHER ...]	Adds cipher to list to be included in negotiation.
no argument	Enables TLS1.2 with DEFAULT cipher suites.

[no] ciphers-tls1.3 <CIPHER[,CIPHER ...]>

Description

List of TLS 1.3 cipher suites (at selected security level) to include in cipher negotiation between clients and servers.

Options

Option	Description
no	Disables TLS1.3
no <CIPHER[,CIPHER ...]>	Removes the specified cipher suite from list.
CIPHER[,CIPHER ...]	Adds cipher to list to be included in negotiation.
no argument	Enables TLS1.3 with DEFAULT cipher suites.

[no] elliptic-curve-only <on | off>

Description

Enable or disable the limitation to only use elliptic curve groups. When enabled, the system will only use elliptic curve groups when negotiating key exchange for supported cipher suites as descriped in RFC 8422 for TLS 1.2 and RFC 8446 for TLS 1.3. This improves the security. Default is off.

Options

Option	Description
no	Sets value to default value (off)
on	Only use following elliptic curve ciphers when negotiating key. secp256r1:secp384r1:secp521r1:x25519:x448:brainpoolP256r1:brainpoolP384r1:brainpoolP512r1
off	Allow use off all curves.

[no] revocation

Description

Enable TLS certificate revocation checking for LDAP connections. When enabled, the certificate revocation status is checked during TLS handshake with the LDAP server.

Options

Option	Description
no	Disables revocation checking.

[no] primary-address <IP | FQDN>

Description

Primary address of the LDAP server.

Options

Option	Description
no	Remove the configured address.
IP	IP address in standard quad-dotted notation, e.g. 192.168.1.1
FQDN	A fully qualified domain name.

[no] secondary-address <IP | FQDN>

Description

Secondary address of the LDAP server, used only if the primary address is unreachable. If no server responds, the device will iterate between the primary and secondary address for each authentication attempt until the configured timeout is reached.

Options

Option	Description
no	Remove the configured secondary address.
IP	IP address in standard quad-dotted notation, e.g. 192.168.1.1.
FQDN	A fully qualified domain name.

[no] credential-cache <on | off>

Description

Enable or disable caching of credentials for this server. When enabled, the system will cache credentials for users authenticated by this server. This can improve availability but may have security implications. With cache on it is possible to log in even if the server is temporarily unreachable if a successful authentication has been done previously. Cached credentials are cleared at reboot and when the configuration is changed. Default is off.

Options

Option	Description
no	Reset to the default value (off).

[no] user-id-mapping UID

Description

Attribute name used to identify users in the LDAP directory. Default is sAMAccountName.

Options

Option	Description
no	Reset to the default value (sAMAccountName).
UID	The LDAP attribute name that contains the username, for example: uid for OpenLDAP sAMAccountName for Active Directory®

[no] base-dn BASE_DN

Description

Base Distinguished Name (DN) of the directory subtree to search for user entries.

Options

Option	Description
no	Clear the configured base DN.
BASE_DN	A DN string, for example: ou=users,dc=example,dc=com dc=corp,dc=com

[no] bind-dn BIND_DN

Description

Bind DN of the service account used for LDAP user lookups.

Options

Option	Description
no	Clear the configured bind DN.
BIND_DN	A DN string, for example: cn=ldap-reader,ou=service-accounts,dc=corp,dc=com

[no] role-base-dn ROLE_BASE_DN

Description

Role base DN of the service account used for LDAP user lookups. If this is filled in the role in the role-map is checked against this DN.

Options

Option	Description
no	Clear the configured role base DN.
ROLE_BASE_DN	A DN string without CN, for example: ou=groups,dc=corp,dc=com

[no] bind-password PASSWORD

Description

Password for the bind DN service account.

Options

Option	Description
no	Remove the configured bind password.
PASSWORD	Password with the following allowed characters: ASCII 33-126 (octal 041-176), max length 64 chars.

[no] search-filter FILTER

Description

LDAP search filter applied when looking up user entries. Parentheses are added automatically if omitted.

Options

Option	Description
no	Clear the configured search filter.
FILTER	An LDAP filter expression, for example: (objectClass=inetOrgPerson)

[no] role-map LOCAL_ROLE REMOTE_LDAP_ROLE

Description

Map a local system role to a remote LDAP group or role attribute value. Multiple role mappings can be configured.

Important

It is not recommended using the same username on the local user account as used with LDAP since it might result in unknown authentication behavior.

Options

Option	Description
no	Remove the mapping for the specified LOCAL_ROLE, or remove all mappings if no role is provided.
LOCAL_ROLE	A valid local role: administrator, engineer, operator, auditor, viewer.
REMOTE_LDAP_ROLE	The corresponding LDAP group DN or role value, for example: CN=NetworkAdmins,OU=Groups,DC=corp,DC=com

Server Group Settings

Configure a server group and enter its configuration context. When creating a server group the ID must be a number from 0 to 1.

note

To use a server group for authentication it must be added to the authentication chain.

example:/config/aaa/#> server-group 0
Creating new server group 0
example:/config/aaa/server-group-0/#>

Syntax

[no] type <radius | tacacs>

Description

Set the remote server type to be either radius or tacacs.

Options

Option	Description
no	Reset the type to its default setting, radius.

[no] description STRING

Description

Free form description of this server group.

Options

Option	Description
no	Remove any description.
STRING	Free form text with a maximum length of 15 characters.

[no] server <ID|ID,ID,...>

Description

Remote server(s) to be part of the server group.

note

When using a server group for authentication each server will be tested in order. If a response is received from any of the servers the remaining ones in the group will not be tested.

Options

Option	Description
no	Remove any configured server IDs.
ID	Id of a remote-server to be part of the server group.

Authentication Chain Settings

The Authentication chains provides a way to specify how the device priorities different authentication methods. It also allows to specify how the device should handle a reject, and the conditions for local fallback at the end of the chain. Each link in the chain may either be a remote server, or a server group..

example:/config/aaa/#> auth-chain
example:/config/aaa/auth-chain/#>

Syntax

Syntax: [no] order <server-id|group-id> [..] Usage: Authentication chain order

[no] order [server-<SID>|group-<GID>] [..]

Description

Set zero or more authentication methods to be used for login requests on the device. NOTE: Order matters

Options

Option	Description
no	Remove any configured authentication methods.
server-<SID>	Use an existing remote-server with the provided SID in the chain.
group-<GID>	Use an existing server-group with the provided GID in the chain.

[no] on-reject next|deny

Description

Dictates how the authentication chain behaves when an authentication method rejects the user credentials. NOTE: Admin accounts are always available over the serial console, regardless of on-reject and local-fallback settings.

Options

Option	Description
no	Reset on-reject to the default value of next
next	When an authentication method rejects the users credentials: Try the next authentication method in order, or local-fallback if there are no more methods.
deny	When an authentication method rejects the users credentials: Deny the login attempt

[no] local-fallback never|serial|always

Description

Acts as a last resort after all other methods fail to give a authorative answer. NOTE: Admin accounts are always available over the serial console, regardless of on-reject and local-fallback settings.

Options

Option	Description
no	Reset local-fallback to the default value of always
never	Only admins accounts over the serial console work.
serial	Local accounts are used as a fallback when logging in over the serial console
always	Local accounts are used as a fallback

Password Compliance Policy Settings

Password compliance policy provides a way to check a password at creation time against a set of policies. If enabling the password compliance policy the password will be checked for compliance when changing an existing users password or adding a new user in the cli or webgui.

Configure the password policy and enter its configuration context:

example:/config/aaa/#> password-policy
Activating password policy with default settings, type 'abort' to cancel.
example:/config/aaa/password-policy/#>

Syntax

[no] enable

Description

This setting controls if the password compliance policy is enabled or disabled. Default is Disabled.

Options

Option	Description
no	Disable password compliance policy

min-length

Description

Set password policy min length <8-64>. Default is 14.

Options

Option	Description
value	Minimum length of password

uppercases

Description

Specify number of uppercase letters <0-64>. Default is 0.

Options

Option	Description
value	Number of uppercase letters

lowercases

Description

Specify number of lowercase letters <0-64>. Default is 0.

Options

Option	Description
value	Number of lowercase letters

digits

Description

Specify number of digits <0-64>. Default is 0.

Options

Option	Description
value	Number of digits

specials

Description

Specify number of special characters <0-64>. Default is 0.

Options

Option	Description
value	Number of special characters

reject-username

Description

Enable/Disable reject username in password. Default is Enabled. If enabled the username, in any form, must not be part of the password.

Options

Option	Description
0	Disabled
1	Enabled

MAC auth group Settings

Configure a MAC auth group and enter its configuration context.

example:/config/#> aaa
example:/config/aaa/#> mac-auth 0
Creating new mac-auth group 0.
Remember, you need to reference it from a Port Access instance as well!
example:/config/aaa/mac-auth-0/#> mac match aa:bb:cc:dd:ee:ff description "My MAC match"
example:/config/aaa/mac-auth-0/#> leave
example:/config/#> leave

Syntax

[no] description STRING

Description

Free form description of this MAC auth group.

Options

Option	Description
no	Remove any description.
STRING	Free form text with a maximum length of 15 characters.

[no] mac match <MAC-PATTERN> [description <STRING>]

Description

Create or delete a Ethernet MAC address pattern.

A single MAC address can be specified in the format: hh:hh:hh:hh:hh:hh

Options

Option	Description
no	Remove MAC-PATTERN

Status

Show any user currently connected to the device, and the authentication method used when connecting to the device.

example:/#> show users
TYPE    USERNAME            REMOTE HOST          LOGIN                        
Console admin                                    Wed Aug 14 08:47:02 2019

Show AAA status, same information as when in config mode.

example:/#> show aaa

Show local-db status, same information as when in config mode.

example:/#> show aaa local-db 1

Show local-db status for all databases.

example:/#> show aaa local-db