Fabric OS Administrator's Guide v6.4.0 (53-1001763-01, June 2010)

100 Fabric OS Administrator’s Guide
53-1001763-01
The authentication model using RADIUS and LDAP
5
To enable RADIUS or LDAP service, it is strongly recommended that you access the CLI through an
SSH connection so that the shared secret is protected. Multiple login sessions can configure
simultaneously, and the last session to apply a change leaves its configuration in effect. After a
configuration is applied, it persists after a reboot or an HA failover.
To enable LDAP service, you need to install a certificate on the Microsoft Active Directory server.
The configuration applies to all switches and on a director the configuration replicates itself on a
standby CP blade if one is present. It is saved in a configuration upload and applied in a
configuration download.
You should configure at least two RADIUS servers so that if one fails, the other will assume service.
You can set the configuration with both RADIUS or LDAP service and local authentication enabled
so that if the RADIUS or LDAP servers do not respond due to power failure or network problems, the
switch uses local authentication.
Consider the effects of the use of RADIUS or LDAP service on other Fabric OS features. For
example, when RADIUS or LDAP service is enabled, all account passwords must be managed on
the RADIUS or LDAP server. The Fabric OS mechanisms for changing switch passwords remain
functional; however, such changes affect only the involved switches locally. They do not propagate
to the RADIUS or LDAP server, nor do they affect any account on the RADIUS or LDAP server.
When RADIUS or LDAP is set up for a fabric that contains a mix of switches with and without
RADIUS or LDAP support, the way a switch authenticates users depends on whether a RADIUS or
LDAP server is set up for that switch. For a switch with RADIUS or LDAP support and configuration,
authentication bypasses the local password database. For a switch without RADIUS or LDAP
support or configuration, authentication uses the switch’s local account names and passwords.
Table 15 on page 100 outlines the aaaConfig command options used to set up the authentication
mode.
TABLE 15 Authentication configuration options
aaaConfig options Description Equivalent setting in Fabric
OS v5.1.0 and earlier
--radius --switchdb
1
--authspec “local” Default setting. Authenticates
management connections against the
local database only.
If the password does not match or the user
is not defined, the login fails.
Off On
--authspec “radius” Authenticates management connections
against any RADIUS databases only.
If the RADIUS service is not available or the
credentials do not match, the login fails.
On Off
--authspec “radius;local” Authenticates management connections
against any RADIUS databases first.
If RADIUS fails for any reason,
authenticates against the local user
database.
not
supported
not
supported