Users Guide

314 Authentication, Authorization, and Accounting
The TACACS+ server can do the authentication itself, or redirect the request
to another back-end device. All sensitive information is encrypted and the
shared secret is never passed over the network; it is used only to encrypt the
data.
Which TACACS+ Attributes Does the Switch Support?
Table 9-7 lists the TACACS+ attributes that the switch supports and
indicates whether the authorization or accounting service supports sending or
receiving the attribute. The authentication service does not use attributes.
The following attributes can be configured on the TACACS+ server(s) when
utilizing the switch TACACS+ service.
Dynamic ACL Overview
NOTE: This feature is only supported in 802.1X-enabled configurations.
Dynamic ACLs allow operators to administer bespoke network access policies
from a central location (the RADIUS server). Access policies are enforced via
the use of ACLs or DiffServ policy installed for the duration of the user
session. Unique policies can be assigned based upon the user
credentials/location/time of day and other information presented to the
RADIUS server during the authentication process. The benefit to the end
user is that the policy can
follow the user around the network, regardless of
Table 9-7. Supported TACACS+ Attributes
Attribute Name Exec Authorization Command
Authorization
Accounting
cmd both (optional) sent sent
cmd-arg sent
elapsed-time sent
priv-lvl received
protocol sent
roles both (optional)
service=shell both sent sent
start-time sent
stop-time sent