Agreed. Before we went to Radius, any time someone left the company we had to updated the router / switch passwords. What a pain. even if you have something that will go out and auto update the passwords, you then have to update the auto update program. Still a pain in my book.<div>
<br></div><div>Radius with a user, with Limited permissions is the way to go.</div><div><br></div><div>Scott<br><br><div class="gmail_quote">On Tue, Jan 4, 2011 at 7:25 AM, Lelio Fulgenzi <span dir="ltr"><<a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><div style="font-family:Verdana;font-size:10pt;color:#000000">And you can easily disable the account and enable it when required (if 24hr/7day/wk access is not required). If you had to create a local account on each router and a security issue arose, bad news.<span><br>
<br><span name="x"></span>---<br>Lelio Fulgenzi, B.A.<br>Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1<br>(519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)<br>^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^<br>
Cooking with unix is easy. You just sed it and forget it. <br> - LFJ (with apologies to Mr. Popeil)<br><span name="x"></span><br></span><br><hr><b>From: </b>"Go0se" <<a href="mailto:me@go0se.com" target="_blank">me@go0se.com</a>><br>
<b>To: </b>"Jason Aarons (US)" <<a href="mailto:jason.aarons@us.didata.com" target="_blank">jason.aarons@us.didata.com</a>>, "Mike King" <<a href="mailto:me@mpking.com" target="_blank">me@mpking.com</a>>, "Cisco VoIPoE List" <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Sent: </b>Tuesday, January 4, 2011 10:23:01 AM<div><div></div><div class="h5"><br><b>Subject: </b>Re: [cisco-voip] OT Radius authentication with a 2800 router<br><br>I don't know how many routers you would have to touch but even if there were<br>
a solution it would be a pain to have to go touch each one. Simply create a<br>generic AD account and if they are worried about network/workstation access<br>don't give the account logon rights on your domain. It will still be able to<br>
log into your network devices. <br> <br>Thanks,<br><br>Go0se<br><br>My blog:<br><a href="http://atc.go0se.com" target="_blank">http://atc.go0se.com</a><br><br>--------------------------------------------<br>Help Hopegivers International<br>
Feed the orphans of Haiti and India<br><a href="http://www.hopegivers.org" target="_blank">http://www.hopegivers.org</a><br>--------------------------------------------<br><br>-----Original Message-----<br>From: <a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a><br>
[mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>] On Behalf Of Jason Aarons (US)<br>Sent: Monday, January 03, 2011 7:03 PM<br>To: Mike King; Cisco VoIPoE List<br>
Subject: Re: [cisco-voip] OT Radius authentication with a 2800 router<br><br>Correct, you need to add them to AD. The fallback method is local usually.<br><br>-----Original Message-----<br>From: <a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a><br>
[mailto:<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>] On Behalf Of Mike King<br>Sent: Monday, January 03, 2011 11:03 AM<br>To: Cisco VoIPoE List<br>Subject: [cisco-voip] OT Radius authentication with a 2800 router<br>
<br>Sorry for the slightly off topic question.<br><br>We've been using Radius authentication with our 2800 routers for a while,<br>but I've been handed an interesting directive.<br><br>We have a third party that will need access to our 2800 routers. I've been<br>
asked to make a local account on the 2800's, as management does not want to<br>added them to the directory (Active Directory) We're using Microsoft NPS<br>(IAS for Server 2008) as a radius backend.<br><br>Unfortunately, it's been my experience, when you enable RADIUS, you cannot<br>
login with local accounts unless the RADIUS server does not respond.<br><br>Am I missing an easy way to do this?<br><br>Mike<br>_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>-----------------------------------------<br>Disclaimer:<br><br>This e-mail communication and any attachments may contain confidential and<br>
privileged information and is for use by the designated addressee(s) named<br>above only. If you are not the intended addressee, you are hereby notified<br>that you have received this communication in error and that any use or<br>
reproduction of this email or its contents is strictly prohibited and may be<br>unlawful. If you have received this communication in error, please notify<br>us immediately by replying to this message and deleting it from your<br>
computer. Thank you.<br><br>_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
<br>_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
</div></div></div></div><br>_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>
<br></blockquote></div><br></div>