HP Cisco Nexus 5000 Cisco Nexus 5000 Series Switch CLI Software Configuration - Page 240

Information About AAA Chapter 16 Configuring AAA Send feedback to [email protected] Based on the user ID and password combination that you provide, the Nexus 5000 Series switches perform local authentication or authorization using the local database or remote authentication or authorization using one or more AAA servers. A preshared secret key provides security for communication between the Nexus 5000 switch and AAA servers. You can configure a common secret key for all AAA servers or for only a specific AAA server. AAA security provides the following services: • Authentication-Identifies users, including login and password dialog, challenge and response, messaging support, and, encryption depending on the security protocol that you select. Authentication is the process of verifying the identity of the person or device accessing the Nexus 5000 Series switches. This process is based on the user ID and password combination provided by the entity trying to access the Nexus 5000 switch. The Nexus 5000 Series switches allow you to perform local authentication (using the local lookup database) or remote authentication (using one or more RADIUS or TACACS+ servers). • Authorization-Provides access control. AAA authorization is the process of assembling a set of attributes that describe what the user is authorized to perform. Authorization in Nexus 5000 Series switches is provided by attributes that are downloaded from AAA servers. Remote security servers, such as RADIUS and TACACS+, authorize users for specific rights by associating attribute-value (AV) pairs, which define those rights with the appropriate user. • Accounting-Provides the method for collecting information, logging the information locally, and sending the information to the AAA server for billing, auditing, and reporting. The accounting feature tracks and maintains a log of every management session used to access the Nexus 5000 Series switches. You can use this information to generate reports for troubleshooting and auditing purposes. You can store accounting logs locally or send them to remote AAA servers. Note The Cisco NX-OS software supports authentication, authorization, and accounting independently. For example, you can configure authentication and authorization without configuring accounting. Benefits of Using AAA AAA provides the following benefits: • Increased flexibility and control of access configuration • Scalability • Standardized authentication methods, such as RADIUS and TACACS+ • Multiple backup devices Remote AAA Services Remote AAA services provided through RADIUS and TACACS+ protocols have the following advantages over local AAA services: • User password lists for each Nexus 5000 Series switch in the fabric are easier to manage. • AAA servers are already deployed widely across enterprises and can be easily used for AAA services. 16-2 Cisco Nexus 5000 Series Switch CLI Software Configuration Guide OL-16597-01