Chapter 17 Troubleshooting Radius And Tacacs; Aaa Overview; Initial Troubleshooting Checklist - Cisco 9134 - MDS Multilayer Fabric Switch Troubleshooting Manual

S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
Troubleshooting RADIUS and TACACS+
The authentication, authorization, and accounting (AAA) mechanism verifies the identity of, grants
access to, and tracks the actions of users managing a switch. All Cisco MDS 9000 Family switches use
the Remote Access Dial-In User Service (RADIUS) and Terminal Access Controller Access Control
System Plus (TACACS+) protocols to provide solutions using remote AAA servers.
This chapter includes the following sections:
•
•
•
•

AAA Overview

Based on the user ID and password combination provided, switches perform local authentication or
authorization using the local database or remote authentication or authorization using AAA server(s). A
preshared secret key provides security for communication between the switch and AAA servers. This
secret key can be configured as a global key for all AAA servers or on a per AAA server basis. This
security mechanism provides a central management capability for AAA servers.
Users authenticated through a remote AAA server cannot create jobs using the command scheduler.
Note

Initial Troubleshooting Checklist

Begin troubleshooting AAA issues by checking the following issues:
Checklist
Use the test aaa server CLI command to verify connectivity to your AAA server.
Verify that you have assigned appropriate attributes on your AAA server for user roles.
Verify that the preshared key is the same on both the switch and the AAA server.
Verify that you have no all-numeric users or passwords configured.
OL-9285-05
AAA Overview, page 17-1
Initial Troubleshooting Checklist, page 17-1
AAA Issues, page 17-2
Troubleshooting RADIUS and TACACS+ With Cisco ACS, page 17-11
C H A P T E R
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
17
Check off
17-1