Table of Contents
Advertisement
Server Overview
Authentication servers are sometimes referred to as AAA servers (authentication, authorization, and
accounting). These servers are used for storing information about users who want to manage the switch
(Authenticated Switch Access) and users who need access to a particular VLAN or VLANs (Authenti-
cated VLANs).
RADIUS, TACACS +, or LDAP servers can be used for Authenticated Switch Access and/or Authenti-
cated VLANs. Another type of server, SecurID ACE/Server, can be used for authenticated switch access
only; the ACE/Server is an authentication-only server (no authorization or accounting). Only RADIUS
servers are supported for 802.1X Port-based Network Access Control.
The following table describes how each type of server can be used with the switch:
Authenticated Switch
Server Type
Access
ACE/Server
yes (except SNMP)
RADIUS
yes (except SNMP)
TACACS+
yes (including SNMP)
LDAP
yes (including SNMP)
Backup Authentication Servers
Each RADIUS, TACACS+, and LDAP server can have one backup host (of the same type) configured
through the
aaa
radius-server,
addition, each authentication method (Authenticated Switch Access, Authenticated VLANs, or 802.1X)
can specify a list of backup authentication servers that includes servers of different types (if supported on
the feature).
The switch uses the first available authentication server to attempt to authenticate users. If user informa-
tion is not found on the first available server, the authentication attempts fails.
Authenticated Switch Access
When RADIUS, TACACS+, and/or LDAP servers are set up for Authenticated Switch Access, the switch
polls the server for user login information. The switch also polls the server for privilege information
(authorization) if it has been configured on the server; otherwise, the local user database is polled for the
privileges.
For RADIUS, TACACS+, and LDAP, additional servers can be configured as backups.
OmniSwitch AOS Release 7 Network Configuration Guide
Authenticated VLANs
no
yes
yes
yes
aaa
tacacs+-server, and
March 2011
802.1X Port-Based
Network Access Control
no
yes
no
no
aaa ldap-server
commands, respectively. In
page 235
Advertisement
Table of Contents
