Remote Aaa Services; Remote Authentication Guidelines; Server Groups; Aaa Service Configuration Options - Cisco MDS 9000 Series Configuration Manual

Remote AAA Services

Remote AAA Services
Remote AAA services provided through RADIUS and TACACS+ protocols have the following advantages
over local AAA services:
• User password lists for each switch in the fabric can be managed more easily.
• AAA servers are already deployed widely across enterprises and can be easily adopted.
• The accounting log for all switches in the fabric can be centrally managed.
• User role mapping for each switch in the fabric can be managed more easily.

Remote Authentication Guidelines

If you prefer using remote AAA servers, follow these guidelines:
• A minimum of one AAA server should be IP reachable.
• Be sure to configure a desired local AAA policy as this policy is used if all AAA servers are not reachable.
• AAA servers are easily reachable if an overlay Ethernet LAN is attached to the switch (see the Cisco
• SAN networks connected to the switch should have at least one gateway switch connected to the Ethernet

Server Groups

You can specify remote AAA servers for authentication, authorization, and accounting using server groups.
A server group is a set of remote AAA servers implementing the same AAA protocol. The purpose of a server
group is to provide for failover servers in case a remote AAA server fails to respond. If the first remote server
in the group fails to respond, the next remote server in the group is tried until one of the servers sends a
response. If all the AAA servers in the server group fail to respond, then that server group option is considered
a failure. If required, you can specify multiple server groups. If the Cisco MDS switch encounters errors from
the servers in the first group, it tries the servers in the next server group.

AAA Service Configuration Options

AAA configuration in Cisco MDS 9000 Family switches is service based. You can have separate AAA
configurations for the following services:
• Telnet or SSH login (Fabric Manager and Device Manager login)
• Console login
• iSCSI authentication (See the Cisco Fabric Manager IP Services Configuration Guide and the Cisco
• FC-SP authentication (See
• Accounting
In general, server group, local, and none are the three options that can be specified for any service in an AAA
configuration. Each option is tried in the order specified. If all the options fail, local is tried.
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
32
Fabric Manager IP Services Configuration Guide and the Cisco MDS 9000 Family NX-OS Configuration
Guide). We recommend this method.
LAN reaching the AAA servers.
MDS 9000 Family NX-OS IP Services Configuration Guide)
About Fabric
Configuring Security Features on an External AAA Server
Authentication)