Ho to prevent vpdn users to access router ?

Oct 16, 2006 2 Replies
J

Hi



I have a router configured as vpdn dial-in device. I authenticate via radius. How can I prevent my dial-in users to login to the router itself. Some of the dial-in users are also admins, and I do not want to remove the radius auth on login.



My config:



aaa authentication login default local group radius aaa authentication login console none aaa authentication ppp default local group radius aaa authorization network default local group radius aaa authorization auth-proxy default group radius



Typical radius users



myuser User-Password == "fatchance" Service-Type = Framed-User, Framed-Protocol = PPP, Filter-Id = "StdUser"



Brgds Johan


Vote
Twitter Facebook LinkedIn
P

Hi John,

How can I prevent my dial-in users to login to the router itself.

radius auth on login.

Its actually very simple, just put an ACL on the VTY port either blocking access from the untrusted segment or allowingn only trusted segments in.

Cheers..............pk.

Vote
Twitter Facebook LinkedIn
J

Well thanks.. Yes, that is one way, but my network admins may move around, and I would like the freedom of allowing them access from whereever they may be. Is there no parameter in Radius where you can control who has access to login to IOS, and who can use the box as endpoint for a vpn ?

Brgds Johan

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required