Rbac Temporary User Role Authorization Configuration Example (Hwtacacs Authentication) - HPE FlexFabric 5940 Series Configuration Manual

[Switch-role-role2] quit
Configure the RADIUS server:
2.
# Add either of the user role attributes to the dictionary file of the FreeRADIUS server.
Cisco-AVPair = "shell:roles=\"role2\""
Cisco-AVPair = "shell:roles*\"role2\""
# Configure the settings required for the FreeRADIUS server to communicate with the switch.
(Details not shown.)
Verifying the configuration
# Telnet to the switch, and enter the username and password to access the switch. (Details not
shown.)
# Verify that you can use all commands available in ISP view.
<Switch> system-view
[Switch] domain abc
[Switch-isp-abc] authentication login radius-scheme abc
[Switch-isp-abc] quit
# Verify that you can use all read and write commands of the radius and arp features. This example
uses radius.
[Switch] radius scheme rad
[Switch-radius-rad] primary authentication 2.2.2.2
[Switch-radius-rad] display radius scheme rad
...
Output of the RADIUS scheme is omitted.
# Verify that you cannot configure any VLAN except VLANs 1 to 20. This example uses VLAN 10 and
VLAN 30.
[Switch] vlan 10
[Switch-vlan10] quit
[Switch] vlan 30
Permission denied.
# Verify that you cannot configure any interface except Ten-GigabitEthernet 1/0/1 to
Ten-GigabitEthernet 1/0/4. This example uses Ten-GigabitEthernet 1/0/2 and Ten-GigabitEthernet
1/0/5.
[Switch] vlan 10
[Switch-vlan10] port ten-gigabitethernet 1/0/2
[Switch-vlan10] port ten-gigabitethernet 1/0/5
Permission denied.
RBAC temporary user role authorization configuration
example (HWTACACS authentication)
Network requirements
As shown in
The user account for the Telnet user is test@bbb and is assigned user role level-0.
Configure the remote-then-local authentication mode for temporary user role authorization. The
switch uses the HWTACACS server to provide authentication for changing the user role among
level-0 through level-3 or changing the user role to network-admin. If the AAA configuration is
invalid or the HWTACACS server does not respond, the switch performs local authentication.
Figure 4, the switch uses local authentication for login users, including the Telnet user.
33