Switch Access In Siom Mode; Using Siom With Stacking - Lenovo Flex System Fabric CN4093 Application Manual

Switch Access in SIOM Mode

Using SIOM with Stacking

© Copyright Lenovo 2017
After the embedded switch is provisioned by the CMM in the SIOM mode, the
switch will automatically update its LDAP settings (startTLS, LDAPS or LDAP)
to the ones configured on the CMM. When no external LDAP server is configured
on the CMM, CMM itself will serve as the local LDAP server. The LDAP client
configured on the CMM is pushed onto the switch and the LDAP credentials used
to access the CMM can also be used to access the switch.
To access the switch, you may now use one of the following methods:
 The CMM credentials
 Other user credentials which depend on the SIOM security policy setting, as
follows:
In legacy mode, if RADIUS or TACACS+ is enabled, they will replace LDAP

as the authentication method. If LDAP backdoor mode is enabled, you can
still use local authentication by using noldap as the username.
In secure mode, you may use the provisioned LDAP credentials.

Notes:
 Once the switch is provisioned by the CMM in SIOM mode, it cannot be
accessed using the switch local user accounts.
 The switch may perform an additional reboot automatically after changing the
SIOM state or upgrading the CMM software.
In stacking mode, configuring SIOM is only supported on the Master switch.
Hence, the command:
CN 4093# [no] boot siom enable
is only supported on the Master switch. On stack member switches, SIOM is
configured by the Master switch, and the member switches automatically inherit
the Master switch SIOM setting. When upgrading to SIOM‐capable software:
 The Master, Backup, and member switches need to be rebooted for SIOM to take
effect.
When SIOM is enabled on the Master, it is applied on all stack members

automatically.
 If a new switch with a different boot SIOM configuration is attached to the stack,
the switch will inherit the boot SIOM configuration from the Master and will
automatically reboot.
When two stacks are joined, the selected Master for the two stacks will push its

own boot SIOM configuration, and the added members will automatically
reboot.
 There will be no changes in the SIOM policy on members if the stack is split.
Note: Lenovo recommends using staggered upgrade. In this case, the upgrade will
take more time, depending on how large the stack setup is, but the traffic loss will
be minimal.
Chapter 39: Secure Input/Output Module
583