Implementing Secure Ldap (Ldaps); Enabling Ldaps - Lenovo RackSwitch G8264 Application Manual

Implementing Secure LDAP (LDAPS)

Enabling LDAPS

1. Turn LDAP authentication on:
2. Enable LDAP Enhanced Mode:
3. Configure the IPv4 addresses of each LDAP server. Specify the interface port
4. You may change the default TCP port number used to listen to LDAPS (optional).
5. Configure the Security Mode:
146
G8264 Application Guide for ENOS 8.4
Lightweight Directory Access Protocol (LDAP) is a protocol for accessing
distributed directory information services over a network. Enterprise NOS uses
LDAP for authentication and authorization. With an LDAP client enabled, the
switch will authenticate a user and determine the user's privilege level by checking
with one or more directory servers instead of a local database of users. This
prevents customers from having to configure local user accounts on multiple
switches; they can maintain a centralized directory instead.
As part of the SIOM, you can implement Secure Lightweight Directory Access
Protocol (LDAPS) in addition to standard LDAP.
LDAPS is disabled by default. To enable LDAPS:
RS G8264(config)# ldap­server enable
RS G8264(config)# ldap­server mode enhanced
This changes the ldap­server subcommands to support LDAPS.
(optional).
RS G8264(config)# ldap­server host {1­4} <IP address or hostname> mgta­port
The well‐known port for LDAP is 636.
RS G8264(config)# ldap­server port <1‐65000>
RS G8264(config)# ldap­server security {clear|ldaps|mutual|starttls}
where:
Parameter
clear
ldaps
mutual
starttls
Description
Cleartext Mode (no security)
LDAPS Mode
Mutual authentication in Transport Layer Security (TLS)
Secure LDAP via StartTLS without cleartext fallback