Cisco AP775A - Nexus Converged Network Switch 5010 User Manual

Send documentation comments to mdsfeedback-doc@cisco.com
41-5
Cisco MDS 9000 Family Fabric Manager Configuration Guide
OL-17256-03, Cisco MDS NX-OS Release 4.x
Chapter 41 Configuring RADIUS and TACACS+
Switch AAA
Caution Cisco MDS NX-OS does not support all numeric usernames, whether created with TACACS+ or
RADIUS, or created locally. Local username with all numerics cannot be created. If an all numeric
username exists on an AAA server and is entered during login, the user is not logged in.
Note Even if local is not specified as one of the options, it is tried when all other configured options fail.
When RADIUS times out, local login is always attempted. For this local login to be successful, a local
account for the user with the same password should exist, and the RADIUS timeout and retries should
take less than 40 seconds. The user is authenticated if the username and password exist in the local
authentication configuration.
AAA Server Monitoring
An unresponsive AAA server introduces a delay in the processing of AAA requests. An MDS switch can
periodically monitor an AAA server to check whether it is responding (or alive) to save time in
processing AAA requests. The MDS switch marks unresponsive AAA servers as dead and does not send
AAA requests to any dead AAA servers. An MDS switch periodically monitors dead AAA servers and
brings them to the alive state once they are responding. This monitoring process verifies that an AAA
server is in a working state before real AAA requests are sent its way. Whenever an AAA server changes
to the dead or alive state, an SNMP trap is generated and the MDS switch warns the administrator that
a failure is taking place before it can impact performance. See
Figure 41-1 for AAA server states.
Figure 41-1 AAA Server States
Note The monitoring interval for alive servers and dead servers is different and can be configured by the user.
The AAA server monitoring is performed by sending a test authentication request to the AAA server.
The user name and password to be used in the test packet can be configured.
See the “Configuring RADIUS Server Monitoring Parameters” section on page 41-7.
No
response
Test
Test
Idle timer
expired
Directed
AAA request
Dead timer expired
Response from
remote server
AAA packets
sent
Alive
Alive and
used
Dead and
testing
Alive and
testing
Dead
Application
request
Process
application
request
154534

Cisco AP775A - Nexus Converged Network Switch 5010 Specifications

General

Brand	Cisco
Model	AP775A - Nexus Converged Network Switch 5010
Category	Switch
Language	English