Remote Aaa Services; Remote Authentication Guidelines; Server Groups; Aaa Service Configuration Options - Cisco AP776A - Nexus Converged Network Switch 5020 Configuration Manual

Switch AAA Functionalities
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

Remote AAA Services

Remote AAA services provided through RADIUS and TACACS+ protocols have the following
advantages over local AAA services:
•
•
•
•

Remote Authentication Guidelines

If you prefer using remote AAA servers, follow these guidelines:
•
•
•
•

Server Groups

You can specify remote AAA servers for authentication, authorization, and accounting using server
groups. A server group is a set of remote AAA servers implementing the same AAA protocol. The
purpose of a server group is to provide for failover servers in case a remote AAA server fails to respond.
If the first remote server in the group fails to respond, the next remote server in the group is tried until
one of the servers sends a response. If all the AAA servers in the server group fail to respond, then that
server group option is considered a failure. If required, you can specify multiple server groups. If the
Cisco MDS switch encounters errors from the servers in the first group, it tries the servers in the next
server group.

AAA Service Configuration Options

AAA configuration in Cisco MDS 9000 Family switches is service based. You can have separate AAA
configurations for the following services:
•
•
•
•
•
In general, server group, local, and none are the three options that can be specified for any service in an
AAA configuration. Each option is tried in the order specified. If all the options fail, local is tried.
Cisco MDS 9000 Family CLI Configuration Guide
34-4
User password lists for each switch in the fabric can be managed more easily.
AAA servers are already deployed widely across enterprises and can be easily adopted.
The accounting log for all switches in the fabric can be centrally managed.
User role mapping for each switch in the fabric can be managed more easily.
A minimum of one AAA server should be IP reachable.
Be sure to configure a desired local AAA policy as this policy is used if all AAA servers are not
reachable.
AAA servers are easily reachable if an overlay Ethernet LAN is attached to the switch (see
Chapter 45, "Configuring IP
SAN networks connected to the switch should have at least one gateway switch connected to the
Ethernet LAN reaching the AAA servers.
Telnet or SSH login (Fabric Manager and Device Manager login)
Console login
iSCSI authentication (see )
FC-SP authentication (see
Accounting
Storage"). We recommend this method.
Chapter 38, "Configuring FC-SP and
Chapter 34 Configuring RADIUS and TACACS+
DHCHAP")
OL-18084-01, Cisco MDS NX-OS Release 4.x