Home » HP Manuals » Storage Devices » HP Cisco MDS 9020 » Manual Viewer

HP Cisco MDS 9020 Cisco Nexus 5000 Series Switch CLI Software Configuration Gu - Page 242

Authentication and Authorization Process for User Login, AAA Service, AAA Methods

Add to My Manuals
Save this manual to your list of manuals

Page 242 highlights

Information About AAA Chapter 16 Configuring AAA Send feedback to [email protected] Table 16-2 AAA Authentication Methods for AAA Services AAA Service Console login authentication User login authentication User management session accounting AAA Methods Server groups, local, and none Server groups, local, and none Server groups and local Note For console login authentication, user login authentication, and user management session accounting, the Nexus 5000 Series switches try each option in the order specified. The local option is the default method when other configured options fail. Authentication and Authorization Process for User Login Figure 16-1 shows a flowchart of the authentication and authorization process for user login. The following process occurs: 1. When you log in to the required Nexus 5000 Series switch, you can use the Telnet, SSH, Fabric Manager or Device Manager, or console login options. 2. When you have configured the AAA server groups using the server group authentication method, the Nexus 5000 Series switch sends an authentication request to the first AAA server in the group as follows: a. If the AAA server fails to respond, then the next AAA server is tried and so on until the remote server responds to the authentication request. b. If all AAA servers in the server group fail to respond, then the servers in the next server group are tried. c. If all configured methods fail, then the local database is used for authentication. 3. If the Nexus 5000 Series switches successfully authenticate you through a remote AAA server, then the following possibilities apply: a. If the AAA server protocol is RADIUS, then user roles specified in the cisco-av-pair attribute are downloaded with an authentication response. b. If the AAA server protocol is TACACS+, then another request is sent to the same server to get the user roles specified as custom attributes for the shell. 4. If your username and password are successfully authenticated locally, the Nexus 5000 Series switch logs you in and assigns you the roles configured in the local database. 16-4 Cisco Nexus 5000 Series Switch CLI Software Configuration Guide OL-16597-01

Section	Page
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide	1
Contents	3
Preface	33
Audience	33
Organization	33
Document Conventions	34
Related Documentation	34
Obtaining Documentation and Submitting a Service Request	35
Product Overview	37
New Technologies in the Cisco Nexus 5000 Series	37
Fibre Channel over Ethernet	37
I/O Consolidation	38
Virtual Interfaces	39
Cisco Nexus 5000 Series Switch Hardware	39
Chassis	39
Expansion Modules	39
Ethernet Interfaces	39
Fibre Channel Interfaces	40
Management Interfaces	40
Cisco Nexus 5000 Series Switch Software	40
Ethernet Switching	40
FCoE and Fibre Channel Switching	41
Licensing	41
QoS	41
Serviceability	41
Switched Port Analyzer	41
Ethanalyzer	42
Call Home	42
Online Diagnostics	42
Switch Management	42
Simple Network Management Protocol	42
Role-Based Access Control	42
Configuration Methods	42
Configuring with CLI, XML Management Interface, or SNMP	43
Configuring with Cisco MDS Fabric Manager	43
Network Security Features	43
Virtual Device Contexts	43
Typical Deployment Topologies	43
Ethernet TOR Switch Topology	44
IOC Topology	45
Supported Standards	46
Configuration Fundamentals	47
Using the Command-Line Interface	49
Accessing the Command Line Interface	49
Using the CLI	50
Using CLI Command Modes	50
Changing Command Modes	51
Listing the Commands Used with Each Command Mode	51
CLI Command Hierarchy	51
EXEC Mode Commands	51
Configuration Mode Commands	53
Using Commands	54
Listing Commands and Syntax	54
Entering Command Sequences	55
Undoing or Reverting to Default Values or Conditions	55
Using Keyboard Shortcuts	55
Using CLI Variables	57
User-Defined Persistent CLI Variables	57
Using Command Aliases	58
Defining Command Aliases	58
Command Scripts	59
Executing Commands Specified in a Script	59
Using CLI Variables in Scripts	60
Setting the Delay Time	61
Configuring the Switch	63
Image Files on the Switch	63
Starting the Switch	64
Boot Sequence	64
Console Settings	65
Upgrading the Switch	66
Upgrade Procedure Summary	66
Detailed Upgrade Procedure	66
Downgrading from a Higher Release	68
Initial Configuration	69
Configuration Prerequisites	69
Initial Setup	70
Preparing to Configure the Switch	70
Default Login	71
Configuring the Switch	71
Changing the Initial Configuration	74
Accessing the Switch	74
Additional Switch Configuration	75
Assigning a Switch Name	75
Configuring Date, Time, and Time Zone	75
Adjusting for Daylight Saving Time or Summer Time	76
NTP Configuration	77
About NTP	77
NTP Configuration Guidelines	78
Configuring NTP	79
NTP CFS Distribution	79
Enabling NTP Distribution	80
Committing NTP Configuration Changes	80
Discarding NTP Configuration Changes	80
Releasing Fabric Session Lock	81
Database Merge Guidelines	81
NTP Session Status Verification	81
Management Interface Configuration	81
About the mgmt0 Interface	82
Configuring the Management Interface	82
Displaying Management Interface Configuration	82
Shutting Down the Management Interface	83
Managing the Switch Configuration	83
Displaying the Switch Configuration	83
Saving a Configuration	84
Clearing a Configuration	84
Using Switch File Systems	84
Setting the Current Directory	84
Displaying the Current Directory	85
Listing the Files in a Directory	85
Creating a Directory	85
Deleting an Existing Directory	85
Moving Files	86
Copying Files	86
Deleting Files	86
Displaying File Contents	87
Displaying File Checksums	87
Saving Command Output to a File	87
Compressing and Uncompressing Files	87
Managing Licenses	89
Licensing Terminology	89
Licensing Model	90
License Installation	91
Obtaining a Factory-Installed License	91
Performing a Manual Installation	92
Obtaining the License Key File	92
Installing the License Key File	92
Backing Up License Files	94
Identifying License Features in Use	94
Uninstalling Licenses	94
Updating Licenses	96
Grace Period Alerts	96
License Transfers Between Switches	97
Verifying the License Configuration	98
LAN Switching	99
Configuring Ethernet Interfaces	101
Information About Ethernet Interfaces	101
About the Interface Command	101
About the Unidirectional Link Detection Parameter	102
UDLD Overview	102
Default UDLD Configuration	103
UDLD Aggressive and Nonaggressive Modes	103
About Interface Speed	104
About the Cisco Discovery Protocol	104
Default CDP Configuration	104
About the Debounce Timer Parameters	104
About MTU Configuration	105
Configuring Ethernet Interfaces	105
Configuring the UDLD Mode	105
Configuring Interface Speed	106
Configuring the Cisco Discovery Protocol	107
Configuring the CDP Characteristics	107
Enabling or Disabling CDP	108
Configuring the Debounce Timer	108
Configuring the Description Parameter	109
Disabling and Restarting Ethernet Interfaces	109
Displaying Interface Information	110
Default Physical Ethernet Settings	112
Configuring VLANs	115
Information About VLANs	115
Understanding VLANs	115
Understanding VLAN Ranges	116
Creating, Deleting, and Modifying VLANs	117
Configuring a VLAN	118
Creating and Deleting a VLAN	118
Entering the VLAN Submode and Configuring the VLAN	119
Adding Ports to a VLAN	120
Verifying VLAN Configuration	120
Configuring Private VLANs	123
About Private VLANs	123
Primary and Secondary VLANs in Private VLANs	124
Understanding Private VLAN Ports	125
Understanding Primary, Isolated, and Community Private VLANs	125
Associating Primary and Secondary VLANs	126
Understanding Broadcast Traffic in Private VLANs	127
Understanding Private VLAN Port Isolation	127
Configuring a Private VLAN	127
Configuration Guidelines for Private VLANs	128
Enabling Private VLANs	128
Configuring a VLAN as a Private VLAN	129
Associating Secondary VLANs with a Primary Private VLAN	129
Configuring an Interface as a Private VLAN Host Port	130
Configuring an Interface as a Private VLAN Promiscuous Port	131
Verifying Private VLAN Configuration	132
Configuring Rapid PVST+	135
Information About Rapid PVST+	135
Understanding STP	136
Overview	136
Understanding How a Topology is Created	136
Understanding the Bridge ID	137
Bridge Priority Value	137
Extended System ID	137
STP MAC Address Allocation	138
Understanding BPDUs	138
Election of the Root Bridge	139
Creating the Spanning Tree Topology	139
Understanding Rapid PVST+	140
Overview	140
Rapid PVST+ BPDUs	142
Proposal and Agreement Handshake	142
Protocol Timers	143
Port Roles	144
Port States	145
Rapid PVST+ Port State Overview	145
Blocking State	146
Learning State	146
Forwarding State	146
Disabled State	147
Summary of Port States	147
Synchronization of Port Roles	147
Processing Superior BPDU Information	148
Processing Inferior BPDU Information	148
Detecting Unidirectional Link Failure	148
Port Cost	149
Port Priority	150
Rapid PVST+ and IEEE 802.1Q Trunks	150
Rapid PVST+ Interoperation with Legacy 802.1D STP	150
Rapid PVST+ Interoperation with 802.1s MST	151
Configuring Rapid PVST+	151
Enabling Rapid PVST+	151
Enabling Rapid PVST+ per VLAN	152
Configuring the Root Bridge ID	153
Configuring a Secondary Root Bridge	154
Configuring the Rapid PVST+ Port Priority	155
Configuring the Rapid PVST+ Pathcost Method and Port Cost	155
Configuring the Rapid PVST+ Bridge Priority of a VLAN	156
Configuring the Rapid PVST+ Hello Time for a VLAN	157
Configuring the Rapid PVST+ Forward Delay Time for a VLAN	157
Configuring the Rapid PVST+ Maximum Age Time for a VLAN	157
Specifying the Link Type	158
Restarting the Protocol	159
Verifying Rapid PVST+ Configurations	159
Configuring MST	161
Information About MST	161
MST Overview	162
MST Regions	162
MST BPDUs	163
MST Configuration Information	163
IST, CIST, and CST	164
IST, CIST, and CST Overview	164
Spanning Tree Operation Within an MST Region	165
Spanning Tree Operations Between MST Regions	165
MST Terminology	166
Hop Count	167
Boundary Ports	167
Detecting Unidirectional Link Failure	168
Port Cost and Port Priority	168
Interoperability with IEEE 802.1D	169
Interoperability with Rapid PVST+: Understanding PVST Simulation	169
Configuring MST	169
MST Configuration Guidelines	170
Enabling MST	170
Entering MST Configuration Mode	171
Specifying the MST Name	172
Specifying the MST Configuration Revision Number	173
Specifying the Configuration on an MST Region	173
Mapping and Unmapping VLANs to MST Instances	175
Mapping Secondary VLANs to Same MSTI as Primary VLANs for Private VLANs	176
Configuring the Root Bridge	176
Configuring a Secondary Root Bridge	177
Configuring the Port Priority	178
Configuring the Port Cost	179
Configuring the Switch Priority	180
Configuring the Hello Time	181
Configuring the Forwarding-Delay Time	182
Configuring the Maximum-Aging Time	182
Configuring the Maximum-Hop Count	182
Configuring PVST Simulation Globally	183
Configuring PVST Simulation Per Port	183
Specifying the Link Type	184
Restarting the Protocol	185
Verifying MST Configurations	185
Configuring STP Extensions	187
Information About STP Extensions	187
Understanding STP Port Types	188
Spanning Tree Edge Ports	188
Spanning Tree Network Ports	188
Spanning Tree Normal Ports	188
Understanding Bridge Assurance	188
Understanding BPDU Guard	189
Understanding BPDU Filtering	189
Understanding Loop Guard	190
Understanding Root Guard	191
Configuring STP Extensions	191
STP Extensions Configuration Guidelines	191
Configuring Spanning Tree Port Types Globally	192
Configuring Spanning Tree Edge Ports on Specified Interfaces	193
Configuring Spanning Tree Network Ports on Specified Interfaces	193
Enabling BPDU Guard Globally	194
Enabling BPDU Guard on Specified Interfaces	195
Enabling BPDU Filtering Globally	196
Enabling BPDU Filtering on Specified Interfaces	196
Enabling Loop Guard Globally	198
Enabling Loop Guard or Root Guard on Specified Interfaces	198
Verifying STP Extension Configuration	199
Configuring Port Channels	201
Information About Port Channels	201
Understanding Port Channels	201
Compatibility Requirements	202
Load Balancing Using Port Channels	203
Understanding LACP	204
LACP Overview	205
LACP ID Parameters	205
Port-Channel Modes	206
LACP Marker Responders	207
LACP-Enabled and Static Port Channels Differences	207
Configuring Port Channels	207
Creating a Port Channel	207
Adding a Port to a Port Channel	208
Configuring Load Balancing Using Port Channels	209
Enabling LACP	210
Configuring Port-Channel Port Modes	210
Configuring the LACP System Priority and System ID	211
Configuring the LACP Port Priority	211
Verifying Port-Channel Configuration	212
Configuring Access and Trunk Interfaces	213
Information About Access and Trunk Interfaces	213
Understanding Access and Trunk Interfaces	213
Understanding IEEE 802.1Q Encapsulation	214
Understanding Access VLANs	215
Understanding the Native VLAN ID for Trunk Ports	215
Understanding Allowed VLANs	216
Configuring Access and Trunk Interfaces	216
Configuring a LAN Interface as an Ethernet Access Port	216
Configuring Access Host Ports	217
Configuring Trunk Ports	218
Configuring the Native VLAN for 802.1Q Trunking Ports	218
Configuring the Allowed VLANs for Trunking Ports	219
Verifying Interface Configuration	220
Configuring the MAC Address Table	221
Information About MAC Addresses	221
Configuring MAC Addresses	221
Configuring a Static MAC Address	222
Configuring the Aging Time for the MAC Table	222
Clearing Dynamic Addresses from the MAC Table	223
Verifying the MAC Address Configuration	223
Configuring IGMP Snooping	225
Information About IGMP Snooping	225
IGMPv1 and IGMPv2	226
IGMPv3	227
IGMP Snooping Querier	227
IGMP Forwarding	227
Configuring IGMP Snooping Parameters	228
Verifying IGMP Snooping Configuration	230
Configuring Traffic Storm Control	233
Information About Traffic Storm Control	233
Guidelines and Limitations	234
Configuring Traffic Storm Control	235
Verifying Traffic Storm Control Configuration	235
Displaying Traffic Storm Control Counters	235
Traffic Storm Control Example Configuration	236
Default Settings	236
Switch Security Features	237
Configuring AAA	239
Information About AAA	239
AAA Security Services	239
Benefits of Using AAA	240
Remote AAA Services	240
AAA Server Groups	241
AAA Service Configuration Options	241
Authentication and Authorization Process for User Login	242
Prerequisites for Remote AAA	243
AAA Guidelines and Limitations	244
Configuring AAA	244
Configuring Console Login Authentication Methods	244
Configuring Default Login Authentication Methods	246
Enabling Login Authentication Failure Messages	246
Enabling MSCHAP Authentication	247
Configuring AAA Accounting Default Methods	248
Using AAA Server VSAs with Nexus 5000 Series Switches	249
About VSAs	249
VSA Format	249
Specifying Cisco Nexus 5000 Series Switch User Roles and SMNPv3 Parameters on AAA Servers	249
Displaying and Clearing the Local AAA Accounting Log	250
Verifying AAA Configuration	250
Example AAA Configuration	250
Default Settings	251
Configuring RADIUS	253
Information About RADIUS	253
RADIUS Network Environments	253
RADIUS Operation	254
RADIUS Server Monitoring	255
Vendor-Specific Attributes	255
Prerequisites for RADIUS	256
Guidelines and Limitations	256
Configuring RADIUS Servers	256
Configuring RADIUS Server Hosts	257
Configuring Global Preshared Keys	258
Configuring RADIUS Server Preshared Keys	258
Configuring RADIUS Server Groups	259
Allowing Users to Specify a RADIUS Server at Login	260
Configuring the Global RADIUS Transmission Retry Count and Timeout Interval	261
Configuring the RADIUS Transmission Retry Count and Timeout Interval for a Server	261
Configuring Accounting and Authentication Attributes for RADIUS Servers	262
Configuring Periodic RADIUS Server Monitoring	263
Configuring the Dead-Time Interval	264
Manually Monitoring RADIUS Servers or Groups	265
Verifying RADIUS Configuration	265
Displaying RADIUS Server Statistics	265
Example RADIUS Configuration	266
Default Settings	266
Configuring TACACS+	267
Information About TACACS+	267
TACACS+ Advantages	268
User Login with TACACS+	268
Default TACACS+ Server Encryption Type and Preshared Key	269
TACACS+ Server Monitoring	269
Prerequisites for TACACS+	270
Guidelines and Limitations	270
Configuring TACACS+	270
TACACS+ Server Configuration Process	270
Enabling TACACS+	271
Configuring TACACS+ Server Hosts	271
Configuring Global Preshared Keys	272
Configuring TACACS+ Server Preshared Keys	273
Configuring TACACS+ Server Groups	273
Specifying a TACACS+ Server at Login	274
Configuring the Global TACACS+ Timeout Interval	275
Configuring the Timeout Interval for a Server	275
Configuring TCP Ports	276
Configuring Periodic TACACS+ Server Monitoring	277
Configuring the Dead-Time Interval	278
Manually Monitoring TACACS+ Servers or Groups	278
Disabling TACACS+	278
Displaying TACACS+ Statistics	279
Verifying TACACS+ Configuration	279
Example TACACS+ Configuration	279
Default Settings	280
Configuring SSH and Telnet	281
Information About SSH and Telnet	281
SSH Server	281
SSH Client	282
SSH Server Keys	282
Telnet Server	282
Prerequisites for SSH	282
Guidelines and Limitations	283
Configuring SSH	283
Generating SSH Server Keys	283
Specifying the SSH Public Keys for User Accounts	284
Specifying the SSH Public Keys in Open SSH Format	284
Specifying the SSH Public Keys in IETF SECSH Format	284
Specifying the SSH Public Keys in PEM-Formatted Public Key Certificate Form	285
Starting SSH Sessions to Remote Devices	286
Clearing SSH Hosts	286
Disabling the SSH Server	286
Deleting SSH Server Keys	286
Clearing SSH Sessions	287
Configuring Telnet	287
Enabling the Telnet Server	287
Starting Telnet Sessions to Remote Devices	288
Clearing Telnet Sessions	288
Verifying the SSH and Telnet Configuration	289
SSH Example Configuration	289
Default Settings	290
Configuring ACLs	291
Information About ACLs	291
IP ACL Types and Applications	291
Application Order	292
Rules	292
Source and Destination	292
Protocols	292
Implicit Rules	293
Additional Filtering Options	293
Sequence Numbers	293
Logical Operators and Logical Operation Units	294
Configuring IP ACLs	294
Creating an IP ACL	295
Changing an IP ACL	295
Removing an IP ACL	296
Changing Sequence Numbers in an IP ACL	297
Applying an IP ACL as a Port ACL	297
Applying an IP ACL as a VACL	298
Verifying IP ACL Configurations	298
Displaying and Clearing IP ACL Statistics	299
Configuring MAC ACLs	299
Creating a MAC ACL	300
Changing a MAC ACL	300
Removing a MAC ACL	301
Changing Sequence Numbers in a MAC ACL	302
Applying a MAC ACL as a Port ACL	302
Applying a MAC ACL as a VACL	303
Verifying MAC ACL Configurations	303
Displaying and Clearing MAC ACL Statistics	303
Information About VLAN ACLs	304
VACLs and Access Maps	304
VACLs and Actions	304
Statistics	305
Configuring VACLs	305
Creating or Changing a VACL	305
Removing a VACL	306
Applying a VACL to a VLAN	306
Verifying VACL Configuration	307
Displaying and Clearing VACL Statistics	307
Default Settings	308
System Management	309
Using Cisco Fabric Services	311
Information About CFS	311
CFS Distribution	312
CFS Distribution Modes	312
Uncoordinated Distribution	313
Coordinated Distribution	313

Match case Limit results 1 per page

Send feedback to [email protected]

16-4

Cisco Nexus 5000 Series Switch CLI Software Configuration Guide

OL-16597-01

Chapter 16

Configuring AAA

Information About AAA

Note

For console login authentication, user login authentication, and user management session accounting,

the Nexus 5000 Series switches try each option in the order specified. The local option is the default

method when other configured options fail.

Authentication and Authorization Process for User Login

Figure 16-1

shows a flowchart of the authentication and authorization process for user login. The

following process occurs:

When you log in to the required Nexus 5000 Series switch, you can use the Telnet, SSH, Fabric

Manager or Device Manager, or console login options.

When you have configured the AAA server groups using the server group authentication method,

the Nexus 5000 Series switch sends an authentication request to the first AAA server in the group

as follows:

If the AAA server fails to respond, then the next AAA server is tried and so on until the remote

server responds to the authentication request.

If all AAA servers in the server group fail to respond, then the servers in the next server group

are tried.

If all configured methods fail, then the local database is used for authentication.

If the Nexus 5000 Series switches successfully authenticate you through a remote AAA server, then

the following possibilities apply:

If the AAA server protocol is RADIUS, then user roles specified in the cisco-av-pair attribute

are downloaded with an authentication response.

If the AAA server protocol is TACACS+, then another request is sent to the same server to get

the user roles specified as custom attributes for the shell.

If your username and password are successfully authenticated locally, the Nexus 5000 Series switch

logs you in and assigns you the roles configured in the local database.

Table 16-2

AAA Authentication Methods for AAA Services

AAA Service

AAA Methods

Console login authentication

Server groups, local, and none

User login authentication

Server groups, local, and none

User management session

accounting

Server groups and local