HP Cisco Nexus 5000 Cisco MDS 9000 Family CLI Configuration Guide - Release 4. - Page 823

Chapter 34 Configuring RADIUS and TACACS+ Switch AAA Functionalities Send documentation comments to [email protected] Step 3 Step 4 When you are successfully authenticated through a remote AAA server, then the following possible actions are taken: • If the AAA server protocol is RADIUS, then user roles specified in the cisco-av-pair attribute are downloaded with an authentication response. • If the AAA server protocol is TACACS+, then another request is sent to the same server to get the user roles specified as custom attributes for the shell. • If user roles are not successfully retrieved from the remote AAA server, then the user is assigned the network-operator role. When your user name and password are successfully authenticated locally, you are allowed to log in, and you are assigned the roles configured in the local database. Figure 34-2 shows a flow chart of the authorization and authentication process. Figure 34-2 Switch Authorization and Authentication Flow Start IInnccoommiinngg aacccceessss request to sswwiittcchh Local Remote First or next server lookup No more servers left Found a RADIUS server Local database lookup Success Failure Access permitted RADIUS Lookup No response Accept Access permitted Denied access 105229 OL-18084-01, Cisco MDS NX-OS Release 4.x Cisco MDS 9000 Family CLI Configuration Guide 34-7