Send documentation comments to mdsfeedback-doc@cisco.com
41-4
Cisco MDS 9000 Family Fabric Manager Configuration Guide
OL-17256-03, Cisco MDS NX-OS Release 4.x
Chapter 41 Configuring RADIUS and TACACS+
Switch AAA
Remote AAA Services
Remote AAA services provided through RADIUS and TACACS+ protocols have the following
advantages over local AAA services:
• User password lists for each switch in the fabric can be managed more easily.
• AAA servers are already deployed widely across enterprises and can be easily adopted.
• The accounting log for all switches in the fabric can be centrally managed.
• User role mapping for each switch in the fabric can be managed more easily.
Remote Authentication Guidelines
If you prefer using remote AAA servers, follow these guidelines:
• A minimum of one AAA server should be IP reachable.
• Be sure to configure a desired local AAA policy as this policy is used if all AAA servers are not
reachable.
• AAA servers are easily reachable if an overlay Ethernet LAN is attached to the switch (see
Chapter 52, “Configuring IP Storage”). We recommend this method.
• SAN networks connected to the switch should have at least one gateway switch connected to the
Ethernet LAN reaching the AAA servers.
Server Groups
You can specify remote AAA servers for authentication, authorization, and accounting using server
groups. A server group is a set of remote AAA servers implementing the same AAA protocol. The
purpose of a server group is to provide for failover servers in case a remote AAA server fails to respond.
If the first remote server in the group fails to respond, the next remote server in the group is tried until
one of the servers sends a response. If all the AAA servers in the server group fail to respond, then that
server group option is considered a failure. If required, you can specify multiple server groups. If the
Cisco MDS switch encounters errors from the servers in the first group, it tries the servers in the next
server group.
AAA Configuration Options
AAA configuration in Cisco MDS 9000 Family switches is service based. You can have separate AAA
configurations for the following services:
• Telnet or SSH login (Fabric Manager and Device Manager login)
• Console login
• iSCSI authentication (see Chapter 50, “Configuring iSCSI”)
• FC-SP authentication (see Chapter 45, “Configuring FC-SP and DHCHAP”)
• Accounting
In general, server group, local, and none are the three options that can be specified for any service in an
AAA configuration. Each option is tried in the order specified. If all the options fail, local is tried.
To Next Page
Loading...
Need help?
General
