How to use 2 AAA server for different login purpose

Hello, could you help me?
This is a part of my configuration; I would like to add another TACACS server, witch should take care of the telnet at vty 0 4.
The Tacacs server 10.20.30.40 takes care of the virtual access, and I have another Tacacs server who takes care of login on our network equipment.
! Cisco 7204 with system flash c7200-io3s56i-mz.121-4.bin
aaa new-model
aaa authentication login default group tacacs+
aaa authentication login no_tacacs enable
aaa authentication ppp default group tacacs+
aaa authorization exec default group tacacs+
aaa authorization network default group tacacs+
aaa accounting exec default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
virtual-profile virtual-template 1
virtual-profile aaa
interface Serial2/0:15
description ISDN30
no ip address
encapsulation ppp
no ip route-cache
no keepalive
dialer pool-member 10
isdn switch-type primary-net5
isdn tei-negotiation first-call
isdn caller xxxxxxx
no fair-queue
compress stac
no cdp enable
ppp authentication chap
ppp multilink
interface Virtual-Template1
ip unnumbered FastEthernet1/0
ip nat outside
ppp authentication chap
tacacs-server host 10.20.30.40 key ********
line con 0
exec-timeout 20 0
password ************
login authentication no_tacacs
transport input none
flowcontrol hardware
line aux 0
line vty 0 4
access-class 1 in
exec-timeout 60 0
password *************
login authentication no_tacacs
transport input telnet
transport output telnet
If I just add
aaa authentication login vtymethod group tacacs+ enable
tacacs-server host 10.50.60.70 key ********
line vty 0 4
login authentication vtymethod
My telnet request ask 10.20.30.40 and I have a deny! Could you help to make a secure solution?
Thanks

Jens
I believe that your solution would be to configure a different tacacs server group with the new server in the new group and to use the new group to authenticate for your vty. The config might look something like this:
aaa group server tacacs+ vty_TAC
server 10.50.60.70
aaa authentication login vtymethod group vty_TAC enable
tacacs-server host 10.50.60.70 key ********
I have configured this type of thing and it worked well. When I configured it I explicitly configured (and named) two different TACACS server groups and referenced specific server groups for each authentication method. I am not clear whether it works to keep the default group tacacs+ and use it for your normal authentication or whether you may need to configure a non-default group for it.
Give it a try and let us know what happens.
HTH
Rick

Similar Messages

How to use single button for different operations

Hi
I am using one button with image having 4 controls like left right up and down...
How to use the single button for 4 different operations??
Is there any way of defining hotspots on single button to do four different operations...
Please have a look at the attached image, u can understand my problem better...
Please let me know ASAP...
Thanks and Regards
Aruna.S.N.

Here ya go:
http://code.google.com/p/flexlib/wiki/ComponentList
If this post answers your question or helps, please mark it as such.

How to use DNS server for name resolution for items which don't exist in active directory domain controller DNS

Dear Experts,
In our office we have a domain controller call it 'Office.com', all computers and corporate servers e.g. exchange, antivirus etc. are member of this 'office.com', it is also having a DNS. All users in office have there preferred DNS set to the corporate
DNS
We are working for ministry and offering services to them from our data center so have many servers which are for ministry but they are in our data center. For all these servers we created another DNS server which contains all entries for these servers in
forward and reverse lookup zones. In this DNS we also created a forward lookup zone for our corporate servers and zone name is 'office.com'
What we are trying to have is name resolution of all servers which are listed in other DNS build in our office on Win 2008 R2 for ministry servers
If the user change his preferred DNS to ministry DNS he can resolve the ministry server but then we can not control any thing through group policy since they are using other DNS and not the corporate DNS.
How this can be done ? like any group policy applied to corporate domain controller must take effect on users and in addition to this user must also be able to resolve server names in ministry project DNS
Please assist ASAP.
regards,

Hello,
ok so the GPO setting doesn't apply in any case.
Clients machines use the first DNS server in the list of configured ones on the NIC. If that one is available search for additional DNS servers will stop.
What i can not really understand is your description about the second DNS server. This should normally either another DC with AD integrated DNS, so everything is replicatedwithin AD replication or you use a secondary DNS on domain member server that pulls
the informations from the Master.
It sounds for me that you have configured a machine with DNS server role and created manually the zone with the same name as the domainand manually create there the required A records?
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://msmvps.com/blogs/mweber/
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

HT204053 how to use same id for different stores

How can i use the same apple id to access apps on different apple stores (in different regions)?

You can only buy content from your own country's store, if you want to but from a different country's store then you will need a valid billing address in that other country, and be in that country when buying from it.
Otherwise you can try requesting that the app that you want to buy be added to your country's store, though ultimately it's the developers of those apps that will have to grant Apple a license to sell them there : http://www.apple.com/feedback/itunes.html

How to use acquired values for different treatments with NI 9188 cDAQ

hi guys, I am trying to use NI DAQ 9188 chasis with 9214 temperature measurement module. I wired 3 modules to the module and split signals. But I am not sure that I can these values into functions vis easily. I am trying to convert them into 1D array, but when I converted to the 1D array I can not see the values and use separetely from each other. For example, I want to multiply just the first value taken from 1st thermocouple. how could I do this. Additionally, the signals in the waveform chart 1 is not smooth. what is the reason of this? thanks in advance.
Egemen
Solved!
Go to Solution.
Attachments:
DAQ_v1.vi ‏82 KB

Hi newbieeng,
It sounds like what you want to use is the Index Array function. You should use the Convert From Dynamic Data function on the signal coming from the DAQ Assistant and then use the Index Array function to access the apropriate data on which you would like to operate. Please refer to the help documentation for more information on the Index Array function. As far as smoothening the signal, try adjusting the properties of the graph, such as Autoscale X and some others in the Properties window.
Regards,
James D.
Applications Engineer
National Instruments

How to configure router to use ip pool on the aaa server for vpn clients

how to configure router to use ip pool on the aaa server for vpn clients . i want to use vpn clients to connect to the router. authenticate using the aaa server username databse and also use the ip pool cretaed on the aaa server. i am not able to find the command on the router pointing to use the pool created on the aaa server. can u some one help me with this command.
sebastan

Hello Sebastan,
what do you use as AAA server (e.g. ACS with TACACS+ or RADIUS) ?
Regards,
GNT

How to configure Email notification for User login's in Exchange Infrastructure?

How to configure Email notification for User login's in Client Machines?

Hi ,
Based on the description , you need to assign logon scripts to the end users via group policy and also use your exchange server as the smtp server in that logon script to relay emails to the internal recipients.
Thanks & Regards S.Nithyanandham

How to use "DHCP Server"?

Hi,
I don't know how to use DHCP Server.
#Features > Networking > Network Management > DHCP Server
There seems to be no item to setting a DHCP Server in the Administrative Tools.
Is there function to which installation is necessary to use DHCP Server.
Thanks,

DHCP server role is typically for Windows Server, but you can get some DHCP capability when you enable Internet Connection Sharing -http://answers.microsoft.com/en-us/windows/forum/windows_7-networking/make-windows-7-act-as-a-dhcp-server/8ff345f2-99b5-4670-bb6f-32d7bb63de3c
Sean Liming - Book Author: Starter Guide SIM (WEI), Pro Guide to WE8S & WES 7, Pro Guide to POS for .NET - www.annabooks.com / www.seanliming.com

I want to know that i have recently create an apple id, i want to know that how i can use this id for gsx(without paid) or how to use this id for knowlaged

i want to know that i have recently create an apple id, i want to know that how i can use this id for gsx(without paid) or how to use this id for knowlaged
pls give braef intro about all this things, i have searched on sites but i am not getting exact thing and meaning pls help
and i wnat to complete hardware exam of mac what should i do
thanks
vicckey

GSX, if you're referring to Apple's service by that name, is available only to employees of Apple-authorized service providers or self-servicing accounts. Unless you are employed by such an organization, you cannot access GSX. If you are employed by such an organization, they should set you up and give you the appropriate login information.
If you are interested in becoming a certified Apple hardware technician, you can find information here:
http://training.apple.com/certification/acmt
Please note, though, that certification does not in and of itself give you access to any of the Apple resouces for support organizations; diagnostic tools, parts ordering, etc. You again must be employed by an authorized Apple support provider before you can gain such access.
I have no idea what "knowlaged" might be.
Regards.

HT201320 I let my students use my IPAD for different Apps. I was wondering if there was any way to lock my email app or sign into it before it opens. Suggestions?

I let my students use my IPAD for different Apps. I was wondering if there was any way to lock my email app or sign into it before it opens. Suggestions?

There is no way to lock the built-in email app. You can remove the password from the Mail, Calendars, Contacts settings, but you'd have to readd and remove that every time, probably not very practical. There are third-party apps that have a login feature within the app, so one of those might work for you. Or you can just use a web interface to your email, if your provider offers that, though many web interfaces don't work very well with mobile web browsers.
Alternatively, if your students just use a single app at any given time, you can lock the iPad to that app via Guided Access:
http://support.apple.com/kb/HT5509
Regards.

If I upgrade to Friefox 3.6 I can't use Loginking software for auto login. Any chnce this will be possible in the future?

I have not upgraded to Firefox 3.6 yet because I am unable to use loginking software for auto login. When will a future update not exclude me from using this software?

I contacted Login King but never got a response. So, I'm hoping that a future update from Firefox will be the answer. How far off is 3.7?

How to specify Host Server for Replicated Virtual Desktops within RDVH Collection

My question about how to specify Host Server for Replicated Virtual Desktops within Collection.
I know there is a aswered thread on this, but that solution (wait a week) didn't work for me.
So i have 2 servers, RDS01 and RDS02 with both 15 Hyper-V VM's and replicating to eachother. That part works fine.
Now I wanted to make it easy for my users I build a Connection Broker: RDCB
All went fine in that setup, but when I want to add the existing VM's from RDS01 and RDS02 to the collection it just radomly adds running ones and replicated ones.
So both RDS01 and RDS02 have 15 VM's running and 15 replica's in stopped state, but when I look in my collection, it says RDS01 has 23 and RDS02 has 7 VM's. When I add them all, I see he wants to add a lot of stopped states replica's from RDS01 instead of
the running ones from RDS02.
How can I specify which one he should use? Or need I disable replication first, setup the whole RDCB collection thing, and then turn replication back on? Or does Hyper-V replication not work at all when used in a collection?
I hope someone can help out here. I'm googling and trying for 1,5 week now, but i can;t get it right.
Thanks in advance.

Hi Robin,
Thanks for your patience.
After you removed Replication from 1 machine on both RDS01 and RDS02, please restart that machine. After that, please add this machine to the RD collection again to test how the issue goes.
As we know, Hyper-V Replica provides asynchronous replication of Hyper-V virtual machines between two hosting servers. It is simple to configure and does not require either shared storage or any particular storage hardware. Any server workload that can be
virtualized in Hyper-V can be replicated. Replication works over any ordinary IP-based network, and the replicated data can be encrypted during transmission. Hyper-V Replica works with standalone servers, failover clusters, or a mixture of both. The servers
can be physically co-located or widely separated geographically. The physical servers do not need to be in the same domain, or even joined to any domain at all.
Currently, would you please add only running state VMs to the RD CB collection? And would you please capture some screenshots of the error message? Thanks very much for your cooperation.
Best regards,
Sophia Sun
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

How to use Flash Builder for Eclipse Luna ( is it possible??)

How to use Flash Builder for Eclipse Luna ( is it possible??)

Yes. I have Flash Builder 4.6 and 4.7 running in different Eclipse Luna installs.
More details at http://forums.adobe.com/message/4527443
On Mac, I had to have the 32bit version of Luna for 4.6, and the 64bit version of Luna for 4.7 (and I recently started using 4.7 with Eclipse Mars).
For 4.6 you need to first download Eclipse 3.6 and install the Flash Builder 4.6 plugin to that Eclipse install. For 4.7 you need to download Eclipse 3.7 and install the plugin to that Eclipse install. Once it's installed in the 3.x version, you can then copy the fb*.link files from the Eclipse 3.x dropins folders into your Eclipse Luna's dropin folder.
There is an issue where something in Flash Builder 4.7 won't work right when using it as a plugin, not sure but it might be something with building ANEs.

Hi Any body Knows How to use CAT Tool for Up Loading?

Hi
If any body knows how to use CAT Tool for up loading transactions, explain the steps.
Our requirement is, we want to up load transactions like Oppor , Quotation,Order etc...we want to up load these transcations from Local system to CRM Server
how to do this? Let me know the steps.
Regards
Venkat

If you have 10,000 or less, CATT is a reasonable method, but I would suspect that you have far more than that if you're needing to load transactions.
LSMW is probably a better way to go if you have more than 10k, but I am not familiar with LSMW

Can any one suggest me how to use drawPixels method for 40 series devices

Hello!
I am using drawPixels method of DirectGraphics class the code I have written is :-
Image offscreen=DirectUtils.createImage(width,height,0x00000000);// width and heights are integer value
public final int MODEL=DirectGraphics.TYPE_INT_8888_ARGB ;
Graphics offgra = offscreen.getGraphics();
DirectGraphics directgraphics = DirectUtils.getDirectGraphics(offgra);
directgraphics.drawPixels(imgData,false,0,width,0,0,width,height,0,MODEL); // imgData is a int array(int imgData[]) which contains required pixels of image.
The above code is working fine with NOKIA 60 series device but when i use it with NOKIA 40 series device it gives java.lang.IllegalArgumentException.
same time if i use :-
directgraphics.drawPixels(imgData,false,0,width,0,0,width,height,0,DirectGraphics .TYPE_USHORT_4444_ARGB ) ;
// imgData is a short array(short imgData[]) which contains required pixels of image. i have used different formet here.
it works fine with 40 series device,
can any one suggest me how to use drawPixels method for 40 series devices with format
DirectGraphics .TYPE_INT_8888_ARGB .

If Remote wipe is activated it can't be undone. And Once the Wipe is done, the device can nö longer be tracked.
Sorry.

How to use 2 AAA server for different login purpose

Similar Messages

Maybe you are looking for