Users Guide

310 Authentication, Authorization, and Accounting
Which TACACS+ Attributes Does the Switch Support?
Table 9-7 lists the TACACS+ attributes that the switch supports and
indicates whether the authorization or accounting service supports sending or
receiving the attribute. The authentication service does not use attributes.
The following attributes can be configured on the TACACS+ server(s) when
utilizing the switch TACACS+ service.
Dynamic ACL Overview
NOTE: This feature is only supported in 802.1X-enabled configurations.
Dynamic ACLs allow operators to administer bespoke network access policies
from a central location (the RADIUS server). Access policies are enforced via
the use of ACLs or DiffServ policy installed for the duration of the user
session. Unique policies can be assigned based upon the user
credentials/location/time of day and other information presented to the
RADIUS server during the authentication process. The benefit to the end
user is that the policy can follow the user around the network, regardless of
where the network is accessed. The benefit to the network administrator is
that policy can be configured once for the user and does not need to be
configured on multiple devices.
Table 9-7. Supported TACACS+ Attributes
Attribute Name Exec Authorization Command
Authorization
Accounting
cmd both (optional) sent sent
cmd-arg sent
elapsed-time sent
priv-lvl received
protocol sent
roles both (optional)
service=shell both sent sent
start-time sent
stop-time sent