Reference Guide

Security | 799
Figure 44-13 shows how to allow or deny a Telnet connection to a user. Users will see a login prompt, even
if they cannot login. No access class is configured for the VTY line. It defaults from the local database.
Figure 44-13. Example Access-Class Configuration Using Local Database
VTY Line Remote Authentication and Authorization
Dell Networking OS retrieves the access class from the VTY line.
The Dell Networking OS takes the access class from the VTY line and applies it to ALL users. Dell
Networking OS does not need to know the identity of the incoming user and can immediately apply the
access class. If the authentication method is radius, TACACS+, or line, and you have configured an access
class for the VTY line, Dell Networking OS immediately applies it. If the access-class is
deny all or deny for
the incoming subnet
, Dell Networking OS closes the connection without displaying the login prompt. The
following example shows how to deny incoming connections from subnet 10.0.0.0 without displaying a
login prompt. The example uses TACACS+ as the authentication mechanism.
Figure 44-14. Example Access Class Configuration Using TACACS+ Without Prompt
VTY MAC-SA Filter Support
Dell Networking OS supports MAC access lists which permit or deny users based on their source MAC
address. With this approach, you can implement a security policy based on the source MAC address.
Note: See also the section Chapter 7, Access Control Lists (ACLs).
Dell(conf)#user gooduser password abc privilege 10 access-class permitall
Dell(conf)#user baduser password abc privilege 10 access-class denyall
Dell(conf)#
Dell(conf)#aaa authentication login localmethod local
Dell(conf)#
Dell(conf)#line vty 0 9
Dell(config-line-vty)#login authentication localmethod
Dell(config-line-vty)#end
Dell(conf)#ip access-list standard deny10
Dell(conf-ext-nacl)#permit 10.0.0.0/8
Dell(conf-ext-nacl)#deny any
Dell(conf)#
Dell(conf)#aaa authentication login tacacsmethod tacacs+
Dell(conf)#tacacs-server host 256.1.1.2 key dell
Dell(conf)#
Dell(conf)#line vty 0 9
Dell(config-line-vty)#login authentication tacacsmethod
Dell(config-line-vty)#
Dell(config-line-vty)#access-class deny10
Dell(config-line-vty)#end
(same applies for radius and line authentication)