Switch AAA Functionalities
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
Remote AAA Services
Remote AAA services provided through RADIUS and TACACS+ protocols have the following
advantages over local AAA services:
Remote Authentication Guidelines
If you prefer using remote AAA servers, follow these guidelines:
You can specify remote AAA servers for authentication, authorization, and accounting using server
groups. A server group is a set of remote AAA servers implementing the same AAA protocol. The
purpose of a server group is to provide for failover servers in case a remote AAA server fails to respond.
If the first remote server in the group fails to respond, the next remote server in the group is tried until
one of the servers sends a response. If all the AAA servers in the server group fail to respond, then that
server group option is considered a failure. If required, you can specify multiple server groups. If the
Cisco MDS switch encounters errors from the servers in the first group, it tries the servers in the next
AAA Service Configuration Options
AAA configuration in Cisco MDS 9000 Family switches is service based. You can have separate AAA
configurations for the following services:
In general, server group, local, and none are the three options that can be specified for any service in an
AAA configuration. Each option is tried in the order specified. If all the options fail, local is tried.
Cisco MDS 9000 Family CLI Configuration Guide
User password lists for each switch in the fabric can be managed more easily.
AAA servers are already deployed widely across enterprises and can be easily adopted.
The accounting log for all switches in the fabric can be centrally managed.
User role mapping for each switch in the fabric can be managed more easily.
A minimum of one AAA server should be IP reachable.
Be sure to configure a desired local AAA policy as this policy is used if all AAA servers are not
AAA servers are easily reachable if an overlay Ethernet LAN is attached to the switch (see
Chapter 44, "Configuring IP
SAN networks connected to the switch should have at least one gateway switch connected to the
Ethernet LAN reaching the AAA servers.
Telnet or SSH login (Fabric Manager and Device Manager login)
iSCSI authentication (see )
FC-SP authentication (see
Storage"). We recommend this method.
Chapter 36, "Configuring FC-SP and
Configuring RADIUS and TACACS+
OL-16184-01, Cisco MDS SAN-OS Release 3.x