Radius configuration

[n00blar]

I have Radius authentication working nicely on my 3700 router.
I need to find out if I can use my Windows password when I want to go in 'enable' mode in the router.
Up until this point I have to remember my 'enable' password in order to make router configuration, but I'd like to use my Windows domain password instead.
I've done this on my PIX, but I don't know if this can be done on a router.

Thanks.

 

[n00blar]

Ok, here's what I've found so far.

This can't be done with a RADIUS server.

You need to have a TACAS+ server or something like Cisco's ACS to get the kind of functionality that I'm looking for.

 

[ADB100]

The problem with using Radius is you can't assign an 'Enable' password to each user. There are 2 workarounds though.

1. When you attempt to change the privilege level (enable) the router (or IOS device) sends a new user authentication request to the Radius server for the user account '$enabXX$' where 'XX' is the privilege level requested. So if you just logged in with your regular Windows User and then typed 'enable' the router would send an authentication request for user '$enab15$' to the Radius Server. You can simply add this user to Active Directory/Windows and make sure it has the relevent privileges. There is a slight security issue here in that you can actually just login directly to the router using the username '$enab15$'. So if you have users who know the enable password they can login withought using thier own user account.

2. The other option is to use Radius Attributes and send a Cisco AV Pair with a privilege level. I assume you are using Microsoft IAS; if so for the Remote Access Policy properties edit the Profile and in the advanced section add a 'Cisco-AV-Pair'. The attribute to set the privilege level to 15 is 'shellriv-lvl=15'. Simply add that as the attribute value. When a user logs in they are automatically given level 15 privilege. If you want users to have different privilege levels then you need to mess about with windows groups and have multiple IAS policies' each policy with a different privilege level set via the Cisco AV Pair.

HTH

Andy