Opinions on best CLI IOS authentication model

Anyone care to mention what works well and what doesn't for alternatives to the default enable/exec password scheme in IOS? I've got RADIUS authentication working on an AP1200, and am thinking of using it elsewhere, but I'm concerned about what happens if the RADIUS server goes down. Can I fall back to enable/exec passwords? Does console access still use these?

Ben
There are a number of alternatives to the default of using line and enable passwords. Most of these alternatives are configured through aaa in IOS. If you have Radius working in an AP1200 then you should have a head start in understanding what to do in IOS.
The basics of configuring aaa authentication is that you refer to method lists. Line passwords are a method list, enable passwords are a method list, radius is a method list. You can refer to multiple method lists for authentication. When you have multiple method lists for authentication the IOS will try the first one and if it is not available IOS will try the next one. So for example you might configure this:
aaa authentication login default group radius line
This will provide authentication for login (by default this includes console, vty lines, but you can change that in the configuration if you want to) and will first try the Radius server but if the Radius server is not available the IOS will use the configured line passwords.
To authenticate privilege mode you might configure this:
aaa authentication enable default group radius enable
This configuration authenticates privilege mode by using the Radius server first and if it is not available IOS will fall back to using the configured enable secret (or password).
HTH
Rick

Similar Messages

Best CLI DVD ripper IYO?

What's the best CLI DVD ripper IYO?
There are quite a few options as far as ripping a DVD from the commandline goes; there's burn, the python script, or dvd-backup, another decent command line utility, or the script on the wiki for use with mplayer's mencoder.
I'm looking for opinions as to which is the best, or alternatively, why you like the one you've got. Being a CLI-fanatic, I want the best ripper I can run in a terminal, with the lowest number of dependencies possible, and preferably no gui at all (i.e. not mencoder, which requires you to have mplayer installed) :cry:
Your thoughts?

shadowhand wrote:Two questions about dumping DVDs: Can you loopmount the dump? And if so, can you rip the loopmount? :shock:
You can loopmount it with mount -o loop movie.img. But why would you want to? You can play them with mplayer -dvd-device movie.img dvd:// or set the dvd device node of your favorite multimedia player to movie.img.
As for the second question: I'm not entirely sure. There'll probably some dvd rippers that can rip from an image. I also know that FreeBSD has a program (vndconfig?) that can create a device node that points at the image. I'm not sure Linux can do something like that. But again: why would you want to?

Best Practice of using Models

Hello,
Could you please tell whats the best to work with models. I have created a seperate Model DC for all my applications.
My Question, should I just import the RFCs into model, not implementing the code, or implementing the code also in component interface controller of the model and use it in my Application DC. whats the best practise.
I would appreciate if somebody could help very briefly on how to work with models to improve the performance.
Thanks,
Sunita.
Message was edited by:
sunita

Hi Sunita,
The concept of development component are relevent from desing time perspective , at runtime there is no difference whether you create Model + Component + Application in one DC or multiple . The DC concept helps to increase the reusability and guides to have better design of your application . For example if you have model in a DC while your Components + UI in seperate DC . Changes in Model ( Reimport / Delete / ...) could be well abstracted from using DC . More over the same model DC could be re-used at multiple places /DCs.
As far as performance is concerned yes it increases from dc build and application development point of view.
I would suggest to have model in seperate DC as this is better desing approach and offers maintenability.
regards
Dhawal

Best way to use Models

Hello,
What is the best practice when using models? Given a scenario like, 1 project has several components. Each component has its view, windows, etc, since the components are separated by functionality.
Is it better to create a model, then add that model to the "used models" on each component? Or should I create a different component, that will handle the model, and expose its data via context on its interface?
regards,
arnold

Hello Arnold,
I have read in one of the SAP Documents, If Models are used in Different Projects (Diff DC's) then create in Separate DC for Models and use it in all the projects.
If Models are in used in one DC with different components, use it with used models.
Regards,
Sridhar

What's the best authentication model for a PRO*C process?

We presently have a system where 5 or so PRO*C-based processes on remote nodes (HP OpenVMS) connect to a database (RH Linux) using Oracle Client and insert data. The current authentication method is for the C based program to read a connection string from a file and use that string to connect via an embedded sqlplus call.
This works fine, however having the string contained in a file isn't all that great an idea, even with the protection we give it. It would be easy for a programmer to recompile & debug the process and read the string, so it's not really all that secure. It also just doesn't seem the best way to do this....
I know this isn't much information to go on, but can anyone suggest a better model for this scenario that avoids putting connection strings and passwords in a file?
Thanks in advance

thanks for your helpfull evaluation.
On the security question is it possible for you to use the Oracle Wallet ?
http://www.stanford.edu/dept/itss/docs/oracle/10g/network.101/b10772/asowalet.htm
Please ask more on that thread or post a question to the section : for security Questions/issues.
Forum Home » Technologies » Security
Hope this helps.
Regards,
Hub

What is the best way to maintain models with common components?

I work for a company that uses MatrixX/SystemBuild (v62.2) to build functional models of trains for use in driver training simulators. We are currently in the early stages of a project in which we will need to build and maintain multiple train models which are likely to have some common components, but may have some significant differences. Before we get too far into the modelling, I would like to come up with a decent method of maintaining the common components while keeping the differences separate.
Ideally, I would like to find a way of quickly and easily determining the difference between two models and a way of conditionally pushing the differences from one model to another - in a similar way that one might diff two text files and conditionally copy the changes in one to another.
I found a script (mx_62.2\sysbld\scripts\compare_catalogs.msc) that seems to accept two catalogs for comparison, outputing a difference log. However, I'm unsure how to use this as I don't know how to load two catalogs within the same instance of Xmath or how to assign a catalog to a variable for passing in to a function. Does anyone know how to use this script?
I am also thinking that it might be useful to be able to convert a catalog to an xml - I can probably write a script to do this, however I am wondering if there's anything freely available to do this.
Does anyone have any other ideas?

Let me first discuss about comparing models, then I'll talk about my ideas about modularization.
Comparing models in anything before v8 is difficult. In v6 or v7, there's no way to load to separate files containing the same yet different superblocks. The tool scripts you found don't seem to be documented anywhere. Given the history of some of the things added into the product, I'm not surprised. Which means that it's useless to us. After looking at the scripts, it's difficult to figure out what the inputs to that script should be. You can launch multiple instances of xmath/sysbld and load the models separately, but that's about it.
One suggestion if you have to compare models is to use the exportcatalog.msc script which will generate a text file containing the SBA commands to re-create the model. Do the same for both models then perform a text difference between the generated SBA commands in the generated files.
Another possibility is to use SBA to get the details of each superblock (similar to exportXXX.msc scripts) into a form that's easier to compare between. I'm going to guess that some kind of generated SBA content is the expected input to the compare_catalogs, but I'm not sure.
Now, within v8, we've created a hierarchical compare tool, that compares model files and shows differences. Copying changes between the compared models is a future enhancement. However, in the context of using v8, you could manually copying the changes between the models using the editor and/or project system as appropriate. Yes, in v8 you can separately load models containing the same named superblocks. Try it, I'll bet you'll like it and it will save you lots of time!
Now, on to modularization. I'm not sure you're use of 'components' is the meaning of the Components feature in Sysbld or not. I'm going to assume that you are not using Components and you're generically using the term components as a set of logically related superblocks, or as I perfer to call them, a module.
The only modularization tool you have in Sysbld is the file. What I mean here is that you are able to group sets of superblocks into separate savefiles (.sbd) then combine them to create a complete model. So, essentially, you will need to partition your model into modules and each module is a separate savefile. Then, you can choose which module (i.e. savefile) to load to construct a complete model.
In v8, there's a project system specifically designed to make this kind of modularization within a project easy and straightforward to use and maintain. I'd suggest that you use v8.
For previous versions, the best you can do is create xmath scripts for each complete model you need. The script will contain all of the steps needed to load the separate modules to make a complete model. Thus, you'd have a different script for each model. Also, becareful in v6,v7 that you'll have to manually manage which superblocks are part of which modules, it's tricky stuff. Again, you'll need to use scripts to help maintain this level of complexity in these versions of the Sysbld.
Now, I do not want to recommend FileSuperBlocks, it's a legacy feature to deal with limited resources not applicable on today's machines.
Also, I can't really recommend the the Component feature in Sysbld. It's really not a component, but more of an object, sort-of. And it sort-of gives you unique names and it sort-of gives you parameters. It will not help with the modularization I think you want so don't use these.
In general, there are features within our latest v8 release of MATRIXx that will help you with all of your issues. If you can, upgrade!
Bob Pizzi
MATRIXx R&D

Best way in using models & Increasing performance

Hi all,
I had some doubts in creation of model objects.
1.How many RFCs can a model object can contain?
2.I had a business senario where i had to use 4 Fm for performing a task.If i craete a single model object for this 4 Fun modules.Will it increase performance or else creating a model object for each fun module.will incresae the performance.
3.Are there any good docs in SDN for Best practices or performance increasing in creation and using of model objects.please do paste the links or anyone have any docs plz send me.
Thanks & Rgards,
Lokesh

HI...
1.How many RFCs can a model object can contain?
SAP recommonds...
RFC Connection pools are specific to JCO Destination.
Therefore, all deployed applications using the same model object pointing to the same JCO destination will share the SAME CONNECTION POOL.
This fact defines both the scope of the connection management and determines the number of oncurrent application that may use the JCO destination.
A MODEL OBJECT SHOULD CONTAIN THOSE RFMS THAT SUPPLY THE FUNCTIONALITY OF EITHER A DISCRETE BUSINESS TASK OR SOME ATOMIC SUBSET OF THE BUSINESS TASK
-> HAVING ONE RFM PER MOEDL IS INEFFICIENT FROM A CONNECTION MANAGEMENT POINT OF VIEW.
-> HAVING ALL YOUR RFMS IN ONE BIG MODEL OBJECT IS INEFFICIENT FROM A REUSE POINT OF VIEW
2.I had a business senario where i had to use 4 Fm for performing a task.If i craete a single model object for this 4 Fun modules.Will it increase performance or else creating a model object for each fun module.will incresae the performance.
As above described if the RFMs supply the functionality for a single task then put it in one model
3.Are there any good docs in SDN for Best practices or performance increasing in creation and using of model objects.please do paste the links or anyone have any docs plz send me.
This is described in JA310 ( Web dynpro JAVA) book. you can download it from marketplace.
PradeeP

Best use of a model in cairngorm

I am a little confused about the use of a model , ModelLocator, in cairngorm
I have it created and it all works fine but whats the best way to access it, Currently i have numerous forms that all do something like
 <fx:Script>
 <![CDATA[
 import com.model.ModelLocator;
 [Bindable] private var model:ModelLocator = ModelLocator.getInstance();
and then later on
 private function fun1(evt:Event):void
 model.something = "blah"
 var s1:String = model.anotherSomething;
or whatever
Is it ok to have varibles all over the place in different mxml files all creating a private var model, does this comsume resouces or is it ok because its static
Also i have several arrayCollections 11+ , plus other stuff in the model, is this ok

Hi JockMahon,
Its ok fine you can go with that..
However remember one thing you will be declaring any variables in the ModelLocator class only if you are using them through out your application .. I mean more than one mxml page or AS files. However if you require any property or variable only within a single file then you can declare it locally within the file instead of decalring it in
ModelLocator.
The ModelLocator class in cairngorm framework is a singleton class so in how many files you have a model variable it will actually refer or return only single static instance of the ModelLocator class.
[Bindable] private var model:ModelLocator = ModelLocator.getInstance();
So how many times you have a variable by using the above style of decalring you will only get a single static reference to the instance of ModelLocator class. No ne instances are created. Its like you get a pointer to the model variable.
Hope it is clear now.
Thanks,
Bhasker

Cisco ISE: 802.1x Timers Best Practices / Re-authentication Timers [EAP-TLS]

Dear Folks,
Kindly, suggest the best recommended values for the timers in 802.1x (EAP-TLS)... Should i keep default all or change or some of them?
Also, what do we need reauthentication timers? Any benefit to use it? Does it prompt to users or became invisible? and What are the best values, in case if we need to use it?
Thanks,
Regards,
Mubasher
My Interface Configuration is as below;
interface GigabitEthernet1/34
switchport access vlan 131
switchport mode access
switchport voice vlan 195
ip access-group ACL-DEFAULT in
authentication event fail action authorize vlan 131
authentication event server dead action authorize vlan 131
authentication event server alive action reinitialize
authentication open
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
mab
snmp trap mac-notification change added
dot1x pae authenticator
dot1x timeout tx-period 5
storm-control broadcast level 30.00
spanning-tree portfast
spanning-tree bpduguard enable

Hello Mubashir,
Many timers can be modified as needed in a deployment. Unless you are experiencing a specific problem where adjusting the timer may correct unwanted behavior, it is recommended to leave all timers at their default values except for the 802.1X transmit timer (tx-period).
The tx-period timer defaults to a value of 30 seconds. Leaving this value at 30 seconds provides a default wait of 90 seconds (3 x tx-period) before a switchport will begin the next method of authentication, and begin the MAB process for non-authenticating devices.
Based on numerous deployments, the best-practice recommendation is to set the tx-period value to 10 seconds to provide the optimal time for MAB devices. Setting the value below 10 seconds may result in the port moving to MAC authentication bypass too quickly.
Configure the tx-period timer.
C3750X(config-if-range)#dot1x timeout tx-period 10

What is the best start powermac g4 model numberm8570?how can i make this model perform at its peek?

what is the best start up disk for powermac g4 model number 8570 ?how can i optimize peek up to date performance for all categories on line for free

DubbleDueces wrote:
what is the best start up disk for powermac g4
There is no "best", there is only the one Apple included with it.

Best approach for Data Modelling.

Hello Experts
I am building a Customer Scorecard involving SD and Marketing in BI 7.0.
There are a couple of existing DSOs, some pushing the data into InfoCubes and some don't. All the reporting is happening from MultiProvider sitting on top of these Data Targets.
The team has a primitive design which says that I additional DSOs be created to extract data from the above mentioned couple of DSOs based on only the Objects that are needed for Customer Scorecard reporting.
This means, I am creating a couple of DSOs as per the current design which is in place.
Upon suggesting to only create a Customer Scorecard MultiProvider on top of the already existing couple of Data Targets (avoiding to recreate addtional DSOs and the hassles of loading and activating them and then loading the data into InfoCubes) and then create the BEx Queries on top of them, the Lead expressed his concerns about the impacts it could have on the existing Data Model and subsequent transports once the Model is complete..!
What is the best practice to handle a situation like this? I see there are 3 ways to go ahead with this:
1. Do as the Lead said, which means creating additional DSOs (extracting data from a couple of required existing DSOs, push this data into 1 InfoCube and then create a MultiProvider on top of this (be aware that there is another similar data model that I need to create which will also be embedded into this MultiProvider) and create BEx Reports from there.
2. Create only the InfoCubes which will extract data from the already existing DSOs (avoid creation of additional DSOs) and then create a MP from where BEx Reports are created.
3. Only create a MultiProvider on all the required and already existing DSOs and InfoCubes, making sure if reporting needs aggregated data for reporting or not and then create BEx Reports from there (avoid creation of additional DSOs, & ICs).
Note: We use Rev-Track to do the Transports.
Which one do you think would be the best way to go and what could be the implications? Eventually, the reporting is done in WAD.
Thanks for your time in advance.
Cheers,
Chandu

Hi,
Case 1 and 2 have similarities. But its purely depend user needs.
I think you may be know the difference between dso and cube.
DSO - holds detailed level data
Cube - holds aggregated data.
As per you needs use any one target only, no need to use DSO---> cube flow for existing flows.
you can decide which you want use DSO or Cube only.
Case 3. if your requirement will suffice with existing dso and at reporting level if you can manage to get the required out put then you can with it. But as my guess with existing target your requirement may won't suffice your needs.
About transports:
You can create one Rev track and assign multiple transports to it.
you can add and release transport one by one rather than all at a time.
if you release all at a time you may get some inconsistency issue and TR won't be released.
Thanks

Looking for best practice Port Authentication

Hello,
I'm currently deploying 802.1x on a campus with Catalyst 2950 and 4506.
There are lots of Printers and non-802.1x devices (around 200) which should be controlled by their mac-address. Is there any "best practice" besides using sticky mac-address learning.
I'm thinking of a central place where alle mac-addresses are stored (i.e. ACS).
Another method would be checking only the first part of the mac-address (vendor OID) on the switch-ports.
Any ideas out there??
regards
Hubert

check out the following link, this provides info on port based authentication, see if it helps :
http://www.cisco.com/en/US/products/hw/switches/ps628/products_configuration_guide_chapter09186a00801cde59.html

[CS3] Whats the best way to track model changes? Document Observer? Selection Observer?

Hello, Usecase I am working on needs to track following events: 1. A page item was created/deleted/resized/moved/etc.. 2. A text was inserted/deleted 3. A page was created/deleted Since the list is quite broad I am wondering if there are known best practices to follow. I have tried attaching to Command manager via Document Observer: InterfacePtr<IDocument> iDocument(this, UseDefaultIID()); InterfacePtr<ISubject> iSubject(iDocument, UseDefaultIID()); iSubject->AttachObserver(ISubject::kRegularAttachment,this, IID_ICOMMANDMGR, IID_IMYDOCOBSERVER); Then during "update" call: if (protocol != IID_IHIERARCHY_DOCUMENT) break; ICommand* iCommand = (ICommand*)changedBy; if (iCommand->GetCommandState() != ICommand::kDone) break; const UIDList itemList = iCommand->GetItemListReference(); if (itemList == nil || itemList.IsEmpty()) break; ClassID commandClassID = ::GetClass(iCommand); if(commandClassID.Get() == kAddToHierarchyCmdBoss || kPlacePICmdBoss) { // do something at new item creation } Problem is "kAddToHierarchyCmdBoss" is not just the one command that is sent while creating a new item. There are dozen others and hence I am not sure if I am watching the right one. Second I tried implementing a selection observer and hope to use HandleSelectionAttibuteChanged. A quick search didnt resulted in any suite that lets me implement my use cases. I was inclined towards command observer because thats at low enough level (and right above database layer) allowing me to trap all model changes. I am not looking for a specific answer/code but more of a guideline how to approach the problem. Suggestions? Comments? Thanks in advance

There is no silver bullet, and while the command mgr can be useful to find out what's going on in general, it is definitely not the place for own dispatching. You'll have to revisit every command before and after execution, and plenty obscure sub-commands nested within larger sequences. If you handle them all this will seriously degrade performance. One good use of command manager notifications is to yield and inspect the matching commands for UI activities, from within your debug build.
In your quoted update(), when you check the protocol you're anyway already discarding the command mgr notifications, because the protocol then would be IID_ICOMMANDMGR. Probably you already have attached a bunch of other protocols?
Comparing to previous versions, the changes listed in 1) are pretty simple, you just subscribe at the document boss, and listen for the protocols IID_IHIERARCHY_DOCUMENT, IID_ITRANSFORM_DOCUMENT, eventually IID_IGEOMETRY_DOCUMENT, IID_IPATHGEOMETRY_DOCUMENT, IID_IINVALSHAPE. These also have an advantage that you get a meaningful theChange (rather than the command mgr's kBeforeDoMessageBoss and alike) and can dispatch on those.
If you have a previous version of InDesign, there used to be a wildcard protocol IID_IPMUNKNOWN that would yield any notifications on the subject so you could dump them out and search for details. Apparently for performance reasons this was removed with CS3 after some plugins used it for release code, IMO Adobe should just have limited the feature to the debug build.
Besides to observers, the service registry is full of other notifications, have a look the the cross reference in sdkdocs/html/classISignalMgr.html for the most prominent ones. One exception here, 2) For text edits, you won't even use observers or signals but kEditCmdPreProcessService / IID_ITEXTEDITPREPROCESS service instead, or its sister IID_ITEXTEDITPOSTPROCESS.
3) Probably you'll again observe the kDocBoss for IID_ISPREADLIST and IID_IMASTERSPREADLIST.
Regarding selection observers and suites, we're talking model changes here so please just forget about them in this place. Selection observers are used to follow the selection from within UI widgets, such as a palette or control strip.
Regards,
Dirk

Update ios on model mb528ll 8gig ipod

picked up used ipod and would like to use it for apps but they say to update opererating system
please advise

I looked it up by your model number. Looks like you have an iPod touch 2nd generation. It's running iOS 4.2, which is as high as it can go. The newest iOS is iOS 7. iOS 4 is a very old iOS and the majority of the apps on the app store require a much newer iOS. It's exteremely rare to find apps that work on iOS 4. The iPod touch is pretty much only good for music, unless you Jailbreak it. If you don't mind me asking, how much did you spend for it?

Idea for Chat Socket (what�s the best maner to send model class?)

I Hava a server/client chat socket. Multitreading to recieve multi-conections. I have a model style class, like a Message, that you send this class for exemplo from Client to Server.
Message Class
* name as String
* msg as String
I used ObjectStreams like ObjectOuputStream and ObjectInputStream to send and receive this object liked. But I need to serialize this model class to send it. Is the best maner to use Object Strams, or have another easy solution to send this class model??
I demand ideas!
Thanks all!

If you are communicating serializable objects between Java clients then sure, ObjectOutputStream & ObjectInputStream are a pretty easy way of doing that.
One downside is that OOS & OIS are difficult to use in non-Java programs. If you want interoperability with other languages you might communicate using e.g. CORBA, XML, or a protocol of your own design. Those require a bit more work and learning though.

Opinions on best CLI IOS authentication model

Similar Messages

Maybe you are looking for