HP StorageWorks 8/80 HP StorageWorks Fabric OS 6.2 administrator guide (5697-0 - Page 90

Clients are the switches that will use the RADIUS server; each client must be defined. By default, all IP addresses are blocked. The HP StorageWorks 4/256 SAN Director, HP StorageWorks DC SAN Backbone Director and HP StorageWorks DC04 SAN Director Switch enterprise-class platforms send their RADIUS requests using the IP address of the active CP. When adding clients, add both the active and standby CP IP addresses so that, in the event of a failover, users can still log in to the switch. Enabling clients 1. Open the $PREFIX/etc/raddb/client.config file in a text editor and add the switches that are to be configured as RADIUS clients. For example, to configure the switch at IP address 10.32.170.59 as a client: client 10.32.170.59 secret = Secret shortname = Testing Switch nastype = other In this example, shortname is an alias used to easily identify the client. Secret is the shared secret between the client and server. Make sure the shared secret matches that configured on the switch (see "Adding a RADIUS server to the switch configuration" on page 96). 2. Save the file $PREFIX/etc/raddb/client.config, and then start the RADIUS server as follows: $PREFIX/sbin/radiusd Configuring RADIUS server support with Windows 2000 The instructions for setting up RADIUS on a Windows 2000 server are listed here for your convenience, but may not be accurate for your network environment. Always check with your system administrator before proceeding with setup. NOTE: All instructions involving Microsoft Windows 2000 can be obtained from www.microsoft.com or your Microsoft documentation. Confer with your system or network administrator prior to configuration for any special needs your network environment may have. Configuring RADIUS service on Windows 2000 consists of the following steps: 1. Installing internet authentication service (IAS) For more information and instructions on installing IAS, see the Microsoft Web site. 2. Enabling the Challenge Handshake Authentication Protocol (CHAP) If CHAP authentication is required, Windows must be configured to store passwords with reversible encryption. Reverse password encryption is not the default behavior; it must be enabled. NOTE: If a user is configured prior to enabling reverse password encryption, the user's password is stored and cannot utilize CHAP. To use CHAP, the password must be re-entered after encryption is enabled. If the password is not re-entered, CHAP authentication will not work and the user will be unable to authenticate from the switch. 3. Configuring a user IAS is the Microsoft implementation of a RADIUS server and proxy. IAS uses the Windows native user database to verify that user login credentials; it does not list specific users, but instead lists user groups. Each user group should be associated with a specific switch login role. For example, you should configure a user group for root, admin, factory, switchAdmin, and user, and then add any users whose logins you want to associate to the appropriate group. 4. Configuring the server For more information and instructions on configuring the server, see the Microsoft Web site. Below is the information you will need to configure the RADIUS server for a B-Series switch. Note that a client is the device that uses the RADIUS server; in this case, it is the switch. 90 Managing user accounts