Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

Optionally, click Add Row to add another directory group. Repeat steps 

 and 

 for each directory 

group that the appliance authenticates.

Submit and commit your changes.

You can also use a RADIUS directory to authenticate users and assign groups of users to Cisco roles. 
The RADIUS server should support the CLASS attribute, which AsyncOS uses to assign users in the 
RADIUS directory to Cisco user roles. AsyncOS supports two authentication protocols for 
communicating with the RADIUS server: Password Authentication Protocol (PAP) and Challenge 
Handshake Authentication Protocol (CHAP).

To assign RADIUS users to Cisco user roles, first set the CLASS attribute on the RADIUS server with 
a string value of 

<radius-group>

, which will be mapped to Cisco user roles. The CLASS attribute may 

contain letters, numbers, and a dash, but cannot start with a dash. AsyncOS does not support multiple 
values in the CLASS attribute. RADIUS users belonging to a group without a CLASS attribute or an 
unmapped CLASS attribute cannot log into the appliance.

If the appliance cannot communicate with the RADIUS server, the user can log in with a local user 
account on the appliance.

If an external user changes the user role for their RADIUS group, the user should log out of the appliance 
and then log back in. The user will have the permissions of their new role.

On the System Administration > Users page, click Enable.

Check the Enable External Authentication option if it is not enabled already.

Enter the hostname for the RADIUS server.

Enter the port number for the RADIUS server. The default port number is 1812.

Enter the Shared Secret password for the RADIUS server.

Enter the number of seconds for the appliance to wait for a response from the server before timing out.

(Optional) Click Add Row to add another RADIUS server. Repeat steps 

–

 for each RADIUS server.

You can add up to ten RADIUS servers.

Enter the number of seconds AsyncOS stores the external authentication credentials before contacting 
the RADIUS server again to re-authenticate in the “External Authentication Cache Timeout” field. 
Default is zero (0).

If the RADIUS server uses one-time passwords, for example passwords created from a token, 
enter zero (0). When the value is set to zero, AsyncOS does not contact the RADIUS server again 
to authenticate during the current session.