HP Cisco MDS 9120 Cisco MDS 9000 Family CLI Configuration Guide, Release 3.x ( - Page 757

Send documentation comments to [email protected] 32 C H A P T E R Configuring RADIUS and TACACS+ The authentication, authorization, and accounting (AAA) feature verifies the identity of, grants access to, and tracks the actions of users managing a switch. All Cisco MDS 9000 Family switches use RADIUS and TACACS+ protocols to provide solutions using remote AAA servers. Based on the user ID and password combination provided, switches perform local authentication or authorization using the local database or remote authentication or authorization using a AAA server. A preshared secret key provides security for communication between the switch and AAA servers. This secret key can be configured for all AAA servers or for only a specific AAA server. This security feature provides a central management capability for AAA servers. This chapter includes the following sections: • Switch Management Security, page 32-1 • Switch AAA Functionalities, page 32-2 • Configuring RADIUS, page 32-8 • Configuring TACACS+, page 32-17 • Configuring Server Groups, page 32-27 • AAA Server Distribution, page 32-30 • MSCHAP Authentication, page 32-34 • Local AAA Services, page 32-35 • Configuring Accounting Services, page 32-36 • Configuring Cisco Access Control Servers, page 32-38 • Default Settings, page 32-41 Switch Management Security Management security in any switch in the Cisco MDS 9000 Family provides security to all management access methods, including the command-line interface (CLI) or Simple Network Management Protocol (SNMP). • CLI Security Options, page 32-2 OL-16184-01, Cisco MDS SAN-OS Release 3.x Cisco MDS 9000 Family CLI Configuration Guide 32-1