HP Cisco MDS 9120 Cisco MDS 9000 Family CLI Configuration Guide, Release 3.x ( - Page 790

MSCHAP Authentication Chapter 32 Configuring RADIUS and TACACS+ Send documentation comments to [email protected] last operation: enable last operation status: success Use the show tacacs+ distribution status command to view the status of the TACACS+ fabric merge as shown in Example 32-12. Example 32-12 Displays the TACACS+ Fabric Merge Status switch# show tacacs+ distribution status distribution : enabled session ongoing: no session db: does not exist merge protocol status: merge activation done last operation: enable last operation status: success MSCHAP Authentication Microsoft Challenge Handshake Authentication Protocol (MSCHAP) is the Microsoft version of CHAP. You can use MSCHAP for user logins to an MDS switch through a remote authentication server (RADIUS or TACACS+). About Enabling MSCHAP By default, the switch uses Password Authentication Protocol (PAP) authentication between the switch and the remote server. If you enable MSCHAP, you need to configure your RADIUS server to recognize the MSCHAP vendor-specific attributes. See the "About Vendor-Specific Attributes" section on page 32-14. Table 32-2 shows the RADIUS vendor-specific attributes required for MSCHAP. Table 32-2 Vendor-ID Number 311 MSCHAP RADIUS Vendor-Specific Attributes Vendor-Type Number Vendor-Specific Attribute 11 MSCHAP-Challenge 211 11 MSCHAP-Response Description Contains the challenge sent by an AAA server to an MSCHAP user. It can be used in both Access-Request and Access-Challenge packets. Contains the response value provided by an user in response to the challenge. It is only used in Access-Request packets. To enable MSCHAP authentication, follow these steps: Step 1 Step 2 Command Purpose switch# config t Enters configuration mode. switch(config)# aaa authentication login Enables MSCHAP login authentication. mschap enable 32-34 Cisco MDS 9000 Family CLI Configuration Guide OL-16184-01, Cisco MDS SAN-OS Release 3.x