HP Cisco Nexus 5000 Cisco MDS 9000 Family CLI Configuration Guide - Release 4. - Page 850

MSCHAP Authentication Chapter 34 Configuring RADIUS and TACACS+ Send documentation comments to [email protected] last operation: enable last operation status: success Use the show tacacs+ distribution status command to view the status of the TACACS+ fabric merge as shown in Example 34-12. Example 34-12 Displays the TACACS+ Fabric Merge Status switch# show tacacs+ distribution status distribution : enabled session ongoing: no session db: does not exist merge protocol status: merge activation done last operation: enable last operation status: success MSCHAP Authentication Microsoft Challenge Handshake Authentication Protocol (MSCHAP) is the Microsoft version of CHAP. You can use MSCHAP for user logins to an MDS switch through a remote authentication server (RADIUS or TACACS+). About Enabling MSCHAP By default, the switch uses Password Authentication Protocol (PAP) authentication between the switch and the remote server. If you enable MSCHAP, you need to configure your RADIUS server to recognize the MSCHAP vendor-specific attributes. See the "About Vendor-Specific Attributes" section on page 34-14. Table 34-2 shows the RADIUS vendor-specific attributes required for MSCHAP. Table 34-2 Vendor-ID Number 311 MSCHAP RADIUS Vendor-Specific Attributes Vendor-Type Number Vendor-Specific Attribute 11 MSCHAP-Challenge 211 11 MSCHAP-Response Description Contains the challenge sent by an AAA server to an MSCHAP user. It can be used in both Access-Request and Access-Challenge packets. Contains the response value provided by an user in response to the challenge. It is only used in Access-Request packets. To enable MSCHAP authentication, follow these steps: Step 1 Step 2 Command switch# config t switch(config)# aaa authentication login mschap enable Purpose Enters configuration mode. Enables MSCHAP login authentication. 34-34 Cisco MDS 9000 Family CLI Configuration Guide OL-18084-01, Cisco MDS NX-OS Release 4.x