How To Enable Clients; Windows 2000; How To Enable Chap - HP AE370A - Brocade 4Gb SAN Switch 4/12 Administrator's Manual

Clients are the switches that will be using the RADIUS server; each client must be defined. By default, all IP
addresses are blocked.
On dual-CP switches (SAN Director 2/128 and 4/256 Director), the switch sends its RADIUS request using
the IP address of the active CP. When adding clients, add both the active and standby CP IP addresses so
that users can still log in the event of a failover.

How to enable clients

1. Open the $PREFIX/etc/raddb/client.config file in a text editor and add the switches that are
to be configured as RADIUS clients.
For example, to configure the switch at IP address 10.32.170.59 as a client:
client 10.32.170.59
secret
shortname
nastype
In this example,
between the client and server. Make sure that the shared secret matches that configured on the switch
(see "To add a RADIUS server to the switch
2. Save the file $PREFIX/etc/raddb/client.config; then start the RADIUS server as follows:
$PREFIX/sbin/radiusd

Windows 2000

Configuring RADIUS service on Windows 2000 consists of the following tasks:
• Installing Internet Authentication Service (IAS)
For more information and instructions on installing IAS, refer to the Microsoft web site.
• Enabling the Challenge Handshake Authentication Protocol (CHAP)
If CHAP authentication is required, then Windows must be configured to store passwords with
reversible encryption. Reverse password encryption is not the default behavior; it must be enabled.
NOTE: If a user is configured prior to enabling reverse password encryption, then the user's password is
stored and cannot utilize CHAP. To use CHAP, the password must be reentered after encryption is enabled.
If the password is not reentered, then CHAP authentication will not work and the user will be unable to
authenticate from the switch.
Configuring a user
•
Internet Authentication Service (IAS) is the Microsoft implementation of a RADIUS server and proxy
uses the Windows native user database to verify user login credentials; it does not list specific users, but
instead lists
example, you should configure a user group for root, admin, factory, switchadmin, and user, and then
add any users whose logins you want to associate to the appropriate group.
• Configuring the server

How to enable CHAP

From the Windows Start menu, select Programs> Administrative Tools> Local Security
1.
Policy to open the Local Security Settings window.
In the Local Security Settings window, expand the Account Policies folder and select the Password
2.
Policy folder.
From the list of policies in the Password Policy folder, right-click Store password using reversible
3.
encryption for all users in the domain, and select Security from the pop-up menu.
4. An additional Local Security Settings window appears. Click the Enabled radio button and then click
OK.
72 Managing user accounts
= Secret
= Testing Switch
= other
shortname
is an alias used to easily identify the client.
user groups
. Each user group should be associated with a specific switch login role. For
configuration" on page 96).
Secret
is the shared secret
.
IAS