TechLibrary

Access Control Overview
Overview of Template Accounts for RADIUS and TACACS+ Authentication Understanding Login Authentication Understanding RADIUS Accounting Understanding VSAs Juniper Networks Vendor-Specific RADIUS Attributes Juniper Networks Vendor-Specific TACACS+ Attributes Understanding Junos OS Access Privilege Levels Junos OS Authentication Order for RADIUS, TACACS+, and Password Authentication Junos OS User Authentication Methods Junos OS User Accounts Overview Junos OS Login Classes Overview Regular Expressions for Allowing and Denying Junos OS Configuration Mode Hierarchies Regular Expressions for Allowing and Denying Junos OS Operational Mode Commands Special Requirements for Junos OS Plain-Text Passwords

Access Control Overview

Overview of Template Accounts for RADIUS and TACACS+ Authentication

Understanding Login Authentication

Understanding RADIUS Accounting

Understanding VSAs

Juniper Networks Vendor-Specific RADIUS Attributes

Juniper Networks Vendor-Specific TACACS+ Attributes

Understanding Junos OS Access Privilege Levels

Junos OS Authentication Order for RADIUS, TACACS+, and Password Authentication

Junos OS User Authentication Methods

Junos OS User Accounts Overview

Junos OS Login Classes Overview

Regular Expressions for Allowing and Denying Junos OS Configuration Mode Hierarchies

Regular Expressions for Allowing and Denying Junos OS Operational Mode Commands

Special Requirements for Junos OS Plain-Text Passwords

Configuration Tasks
Configuring Access Privilege Levels Configuring CLI Tips Configuring Junos OS User Accounts Configuring the Junos OS Authentication Order for RADIUS, TACACS+, and Local Password Authentication Configuring Local User Template Accounts for User Authentication Configuring Management Access Configuring RADIUS System Accounting Configuring RADIUS Authentication Configuring Remote Template Accounts for User Authentication Configuring the Root Password Configuring SNMP Configuring SSH Host Keys for Secure Copying of Data Configuring SSH Service for Remote Access to the Router or Switch Configuring TACACS+ Authentication Configuring TACACS+ System Accounting Defining Junos OS Login Classes Limiting the Number of User Login Attempts for SSH and Telnet Sessions Recovering the Root Password Specifying Access Privileges for Junos OS Configuration Mode Hierarchies Specifying Access Privileges for Junos OS Operational Mode Commands Using Junos OS to Configure Logical System Administrators Using Regular Expressions on a RADIUS or TACACS+ Server to Allow or Deny Access to Commands VSA Match Conditions and Actions

Configuration Tasks

Configuring Access Privilege Levels

Configuring CLI Tips

Configuring Junos OS User Accounts

Configuring the Junos OS Authentication Order for RADIUS, TACACS+, and Local Password Authentication

Configuring Local User Template Accounts for User Authentication

Configuring Management Access

Configuring RADIUS System Accounting

Configuring RADIUS Authentication

Configuring Remote Template Accounts for User Authentication

Configuring the Root Password

Configuring SNMP

Configuring SSH Host Keys for Secure Copying of Data

Configuring SSH Service for Remote Access to the Router or Switch

Configuring TACACS+ Authentication

Configuring TACACS+ System Accounting

Defining Junos OS Login Classes

Limiting the Number of User Login Attempts for SSH and Telnet Sessions

Recovering the Root Password

Specifying Access Privileges for Junos OS Configuration Mode Hierarchies

Specifying Access Privileges for Junos OS Operational Mode Commands

Using Junos OS to Configure Logical System Administrators

Using Regular Expressions on a RADIUS or TACACS+ Server to Allow or Deny Access to Commands

VSA Match Conditions and Actions

Configuration Examples
Example: Changing the Requirements for Junos OS Plain-Text Passwords Example: Configuring Access Privilege Levels Example: Configuring Access Privileges for Operational Mode Commands Example: Configuring a Plain-Text Password for Root Logins Example: Configuring RADIUS Authentication Example: Configuring RADIUS System Accounting Example: Configuring the Root Password Example: Configuring SSH Authentication for Root Logins Example: Configuring User Accounts Example: Configuring System Authentication for RADIUS, TACACS+, and Password Authentication Example: Creating Login Classes with Specific Privileges Example: Configuring User Login Accounts Example: Configuring RADIUS Template Accounts Defining Access Privileges Using allow/deny-configuration Statements Example: Limiting the Number of Login Attempts for SSH and Telnet Sessions

Configuration Examples

Example: Changing the Requirements for Junos OS Plain-Text Passwords

Example: Configuring Access Privilege Levels

Example: Configuring Access Privileges for Operational Mode Commands

Example: Configuring a Plain-Text Password for Root Logins

Example: Configuring RADIUS Authentication

Example: Configuring RADIUS System Accounting

Example: Configuring the Root Password

Example: Configuring SSH Authentication for Root Logins

Example: Configuring User Accounts

Example: Configuring System Authentication for RADIUS, TACACS+, and Password Authentication

Example: Creating Login Classes with Specific Privileges

Example: Configuring User Login Accounts

Example: Configuring RADIUS Template Accounts

Defining Access Privileges Using allow/deny-configuration Statements

Example: Limiting the Number of Login Attempts for SSH and Telnet Sessions

Configuration Statements
access accounting accounting-options accounting-server accounting-stop-on-access-deny accounting-stop-on-failure agent-address archival archive-sites authentication-order authentication-server authorization categories client-list client-list-name clients commit-delay community configuration connection-limit contact falling-threshold (Health Monitor) filter-duplicates full-name health-monitor idle-timeout interval (Health Monitor) lldp location name nas-ip-address nonvolatile oid order port (RADIUS Server) profile protocols protocol-version radius radius-options radius-server rate-limit remote-debug-permission retry rising-threshold (Health Monitor) root-login services snmp ssh system tacplus-options targets transfer-interval transfer-on-commit trap-group trap-options user version

Configuration Statements

accounting-stop-on-access-deny

accounting-stop-on-failure

authentication-server