HP AP775A Cisco MDS 9000 Family Fabric Manager Configuration Guide - Release 4 - Page 855

Chapter 41 Configuring RADIUS and TACACS+ Switch AAA Send documentation comments to [email protected] Caution Cisco MDS NX-OS does not support all numeric usernames, whether created with TACACS+ or RADIUS, or created locally. Local username with all numerics cannot be created. If an all numeric username exists on an AAA server and is entered during login, the user is not logged in. Note Even if local is not specified as one of the options, it is tried when all other configured options fail. When RADIUS times out, local login is always attempted. For this local login to be successful, a local account for the user with the same password should exist, and the RADIUS timeout and retries should take less than 40 seconds. The user is authenticated if the username and password exist in the local authentication configuration. AAA Server Monitoring An unresponsive AAA server introduces a delay in the processing of AAA requests. An MDS switch can periodically monitor an AAA server to check whether it is responding (or alive) to save time in processing AAA requests. The MDS switch marks unresponsive AAA servers as dead and does not send AAA requests to any dead AAA servers. An MDS switch periodically monitors dead AAA servers and brings them to the alive state once they are responding. This monitoring process verifies that an AAA server is in a working state before real AAA requests are sent its way. Whenever an AAA server changes to the dead or alive state, an SNMP trap is generated and the MDS switch warns the administrator that a failure is taking place before it can impact performance. See Figure 41-1 for AAA server states. Figure 41-1 AAA Server States Application request Alive Idle timer expired Alive and used Alive and testing Dead and testing Process application request Response from remote server Test Test AAA packets sent No response Directed AAA request Dead Dead timer expired 154534 Note The monitoring interval for alive servers and dead servers is different and can be configured by the user. The AAA server monitoring is performed by sending a test authentication request to the AAA server. The user name and password to be used in the test packet can be configured. See the "Configuring RADIUS Server Monitoring Parameters" section on page 41-7. OL-17256-03, Cisco MDS NX-OS Release 4.x Cisco MDS 9000 Family Fabric Manager Configuration Guide 41-5