Authentication And Authorization Process - HP Cisco MDS 9020 - Fabric Switch Configuration Manual

Switch AAA Functionalities
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
server is in a working state before real AAA requests are sent its way. Whenever an AAA server changes
to the dead or alive state, an SNMP trap is generated and the MDS switch warns the administrator that
a failure is taking place before it can impact performance. See
Figure 32-1
Alive
The monitoring interval for alive servers and dead servers is different and can be configured by the user.
Note
The AAA server monitoring is performed by sending a test authentication request to the AAA server.
The user name and password to be used in the test packet can be configured.
See the
RADIUS Server Details" section on page

Authentication and Authorization Process

Authentication is the process of verifying the identity of the person managing the switch. This identity
verification is based on the user ID and password combination provided by the person managing the
switch. The Cisco MDS 9000 Family switches allow you to perform local authentication (using the
lookup database) or remote authentication (using one or more RADIUS servers or TACACS+ servers).
The following steps explain the authorization and authentication process:
Step 1 You can log in to the required switch in the Cisco MDS 9000 Family, using the Telnet, SSH, Fabric
Manager/Device Manager, or console login options.
Step 2 When you have configured server groups using the server group authentication method, an
authentication request is sent to the first AAA server in the group.
•
•
•
Cisco MDS 9000 Family CLI Configuration Guide
32-6
AAA Server States
Application
request
Idle timer
expired
"Configuring RADIUS Server Monitoring Parameters" section on page 32-12 and"Displaying
If the AAA server fails to respond, then the next AAA server is contacted and so on until the remote
server responds to the authentication request.
If all AAA servers in the server group fail to respond, then the servers in the next server group are
contacted.
If all configured methods fail, then the local database is used for authentication.
Alive and Process
used application
request
Alive and Test
testing
Test
Dead and
testing
32-15.
Chapter 32 Configuring RADIUS and TACACS+
Figure 32-1 for AAA server states.
Response from
remote server
No
response
AAA packets
sent
Directed
AAA request
Dead timer expired
OL-16184-01, Cisco MDS SAN-OS Release 3.x
Dead