Radius Authorization; Radius Accounting - Dell PowerConnect B-FCXs Configuration Manual

32
Configuring RADIUS security
2. The user is prompted for a username and password.
3. The user enters a username and password.
4. The Dell PowerConnect device sends a RADIUS Access-Request packet containing the
5. The RADIUS server validates the Dell PowerConnect device using a shared secret (the RADIUS
6. The RADIUS server looks up the username in its database.
7.
8. If the password is valid, the RADIUS server sends an Access-Accept packet to the Dell
9. The user is authenticated, and the information supplied in the Access-Accept packet for the

RADIUS authorization

When RADIUS authorization takes place, the following events occur.
1. A user previously authenticated by a RADIUS server enters a command on the Dell
2. The Dell PowerConnect device looks at its configuration to see if the command is at a privilege
3. If the command belongs to a privilege level that requires authorization, the Dell PowerConnect
4. If the command list indicates that the user is authorized to use the command, the command is

RADIUS accounting

RADIUS accounting works as follows.
1182
username and password to the RADIUS server.
key).
If the username is found in the database, the RADIUS server validates the password.
PowerConnect device, authenticating the user. Within the Access-Accept packet are three Dell
vendor-specific attributes that indicate:
•
The privilege level of the user
•
A list of commands
•
Whether the user is allowed or denied usage of the commands in the list
The last two attributes are used with RADIUS authorization, if configured.
user is stored on the Dell PowerConnect device. The user is granted the specified privilege
level. If you configure RADIUS authorization, the user is allowed or denied usage of the
commands in the list.
PowerConnect device.
level that requires RADIUS command authorization.
device looks at the list of commands delivered to it in the RADIUS Access-Accept packet when
the user was authenticated. (Along with the command list, an attribute was sent that specifies
whether the user is permitted or denied usage of the commands in the list.)
NOTE
After RADIUS authentication takes place, the command list resides on the Dell PowerConnect
device. The RADIUS server is not consulted again once the user has been authenticated. This
means that any changes made to the user command list on the RADIUS server are not
reflected until the next time the user is authenticated by the RADIUS server, and the new
command list is sent to the Dell PowerConnect device.
executed.
PowerConnect B-Series FCX Configuration Guide
53-1002266-01