Authentication Servers On The Switch - HP SN3000B Administrator's Manual

5
The authentication model using RADIUS and LDAP

Authentication servers on the switch

At least one RADIUS or LDAP server must be configured before you can enable RADIUS or LDAP
service. You can configure the RADIUS or LDAP service even if it is disabled on the switch. You can
configure up to five RADIUS or LDAP servers. You must be logged in as admin or switchAdmin to
configure the RADIUS service.
NOTE
On dual-CP Backbones (Brocade DCX and DCX-4S devices), the switch sends its RADIUS or LDAP
request using the IP address of the active CP. When adding clients, add both the active and standby
CP IP addresses so that users can still log in to the switch in the event of a failover.
RADIUS or LDAP configuration is chassis-based configuration data. On platforms containing
multiple switch instances, the configuration applies to all instances. The configuration is persistent
across reboots and firmware downloads. On a chassis-based system, the command must replicate
the configuration to the standby CP.
Multiple login sessions can invoke the command simultaneously. The last session that applies the
change is the one whose configuration is in effect. This configuration is persistent after an HA
failover.
The RADIUS or LDAP servers are contacted in the order they are listed, starting from the top of the
list and moving to the bottom.
Adding a RADIUS or LDAP server to the switch configuration
1. Connect to the switch and log in using an account with admin permissions.
2. Enter the aaaConfig
At least one RADIUS or LDAP server must be configured before you can enable the RADIUS or LDAP
service.
If no RADIUS or LDAP configuration exists, turning on the RADIUS authentication mode triggers an
error message. When the command succeeds, the event log indicates that the configuration is
enabled or disabled.
Enabling and disabling a RADIUS or LDAP server
1. Connect to the switch and log in using an account with admin permissions.
2. Enter the aaaConfig
Deleting a RADIUS or LDAP server from the configuration
1. Connect to the switch and log in using an account with admin permissions.
2. Enter the aaaConfig
112
add command.
--
authspec command to enable RADIUS or LDAP using the local
--
database.
You must specify the type of server as either RADIUS or LDAP, but not both. Local is used for
local authentication if the user authentication fails on the RADIUS or LDAP server.
Example of enabling RADIUS
switch:admin> aaaconfig --authspec "radius;local" --backup
remove command.
--
When the command succeeds, the event log indicates that the server is removed.
Fabric OS Administrator's Guide
53-1002446-01