Home » HP Manuals » Storage Devices » HP StorageWorks MSA 2/8 » Manual Viewer

HP StorageWorks MSA 2/8 HP StorageWorks Fabric OS 3.X Document Addendum (AA-RW - Page 137

Considerations for RADIUS Use, Advanced Web Tools. The following items apply

View all HP StorageWorks MSA 2/8 manuals

Add to My Manuals
Save this manual to your list of manuals

Page 137 highlights

Fabric OS procedures user guide To enable RADIUS service, access the CLI through an SSH connection so that the shared secret is protected. Multiple login sessions can configure simultaneously, and the last session to apply a change leaves its configuration in effect. After a configuration is applied, it persists after a reboot or an HA failover. The configuration is chassis-based, so it applies to all logical switches (domains) on the switch and replicates itself on a standby CP card, if one is present. It is saved in a firmware upload, so it can be applied to other switches in a firmware download. Configure at least two RADIUS servers so that if one fails, the other assumes service. You can set the configuration with both RADIUS service and local authentication enabled so that if all RADIUS servers do not respond (because of power failure or network problems), the switch uses local authentication. Considerations for RADIUS Use Consider the following effects of the use of RADIUS service on other Fabric OS features: ■ Passwords - When RADIUS service is enabled, all account passwords must be managed on the RADIUS server. The Fabric OS mechanisms for changing switch passwords remain functional; however, such changes affect only the involved switches locally. They do not propagate to the RADIUS server, nor do they affect any account on the RADIUS server. - When RADIUS is set up for a fabric that contains a mix of switches running v4.4.0, v3.2.x, or earlier, the way a switch authenticates users depends on whether a RADIUS server is set up for that switch. For a switch with RADIUS support and configuration, authentication bypasses the local password database. For a switch without RADIUS support or configuration, authentication uses switch local account names and passwords. ■ Secure Fabric OS. In secure mode, the following items apply: - Account passwords are distributed among all switches in the same fabric. An account that resides on several switches has the same password on all of them. This model applies with RADIUS integration; such a distribution affects only the switch local password database. - There are separate admin and nonfcsadmin roles in secure mode. A nonfcsadmin account on a RADIUS server cannot access FCS switches, even if the account is properly authenticated. - If a nonfcsadmin account on a RADIUS server logs in to a switch in nonsecure mode, the switch treats the role like the admin role and grants the access. - The secure Fabric OS telnet policy does not affect the operation of the RADIUS protocol. ■ Advanced Web Tools. The following items apply: - Advanced Web Tools client and server keep an open session after a user is authenticated. A password change on a switch invalidates an open session and requires the user to log in again. When integrated with RADIUS, a switch password change on the RADIUS server does not invalidate an existing open session. However, a password change on the local switch does invalidate an existing open session. - If you cannot log in because of a RADIUS server connection problem, Advanced Web Tools displays a message indicating server outage. Fabric OS 3.x Document Addendum 137

Section	Page
Contents	3
About this Guide	9
Overview	10
Intended audience	10
Related documentation	10
Conventions	11
Document conventions	11
Table 1: Document conventions	11
Text symbols	11
Getting help	12
HP technical support	12
HP storage web site	12
HP authorized reseller	12
Advanced performance monitor user guide	13
ISL Monitoring	13
Using ISL Monitoring	14
Displaying ISL Monitors	14
Clearing ISL Monitors	15
Advanced Web Tools user guide	17
Figure 1: Port information view	18
Table 2: Supported platforms	18
Configuring the Web Browser	19
Configuring Internet Explorer	19
Configuring Mozilla	19
Installing the Java Plug-in on Windows XP, 2000, or NT	20
Installing the Java Plug-in on Windows XP, 2000, or 2003	20
Two and Four Domain Fabric Licensing	20
Figure 2: Switch status window	21
Figure 3: Switch status window, port detail	22
Figure 4: Switch events window	23
Filtering Switch Events	23
Figure 5: Event filter dialog box	24
Filtering Events by Time Intervals	24
Filtering Events by Event Severity	24
Figure 6: Switch Information Tab	26
Figure 7: Network Configuration Tab	27
About the Firmware Tab	28
Firmware Tab Example	28
Figure 8: Firmware Tab	28
Firmware Field Descriptions	29
Table 3: Firmware field descriptions	29
Using the Upload/Download Tab	29
Using the Firmware Tab	29
Performing a Fast Boot	30
Performing a Reboot	30
Figure 9: SNMP Tab (Secure Mode disabled)	31
Figure 10: License Admin Tab	33
Figure 11: Port Setting Tab	35
Figure 12: Configure (Fabric) Tab	37
Figure 13: Configure (Virtual Channel) Tab	39
Figure 14: Configure (Arbitrated Loop) Tab	40
Figure 15: Configure (System) Tab	41
Configure (Upload/Download) Tab Example	42
Figure 16: Configure (Upload/Download) Tab	42
Configure (Upload/Download) Field Descriptions	42
Table 4: Configure (Upload/Download) Field Descriptions	43
Backing Up a Switch Config File	43
Performing a Config Download to a Switch	43
Figure 17: Routing (FSPF Route) Tab	44
Figure 18: Routing (Static Route) Tab	45
Figure 19: Routing (Link Cost) Tab	46
Extended Fabric Tab Example	47
Figure 20: Extended Fabric Tab	47
AAA Service Tab Example	49
Figure 21: AAA Service Tab	49
AAA Service Tab Field Descriptions	50
Table 5: AAA Service Tab Field Descriptions	50
Enabling and Disabling the RADIUS Server	50
Configuring the RADIUS Server	50
Modifying the RADIUS Server	51
Modifying the RADIUS Server Order	51
Removing a RADIUS Server	52
Figure 22: Trunk Information Tab	52
Figure 23: Alarm Notification Tab	53
Figure 24: Threshold Configuration Area Configuration Tab	54
Table 6: Threshold Configuration Tab Components	55
Trait Configuration Tab	55
Table 7: Trait Configuration Components	55
Alarm Configuration Tab	56
Table 8: Alarm Configuration Components	56
Figure 25: Email Configuration Tab	56
Table 9: Email Configuration Field Descriptions	58
Figure 26: The Fabric Events Window	59
Filtering Fabric Events	59
Filtering Events by Time Intervals	59
Filtering Events by Event Severity	60
Figure 27: Name Server Table Window	61
Table 10: Name Server Description of Columns	62
Displaying Name Server Information for a Device	62
Displaying Zone Members of a Device	63
Figure 28: Device Detail View Example	64
Viewing Detailed Information About the Enabled Zone Configuration	64
Figure 29: Alias Tab	67
Figure 30: Zone Tab	68
Figure 31: Fabric Assist Tab	69
Figure 32: Config Tab	70
Displaying an Initiator/Target Accessibility	71
Zoning version user guide	73
Table 11: Zoning Database Limitations	74
Diagnostic and system error messages reference guide	75
Message	75
Probable Cause	75
Recommended Action	75
Severity	75
Message	76
Probable Cause	76
Recommended Action	76
Severity	76
Message	76
Probable Cause	76
Recommended Action	76
Severity	76
Message	77
Probable Cause	77
Recommended Action	77
Severity	77
Message	77
Probable Cause	77
Recommended Action	77
Severity	77
Message	78
Probable Cause	78
Recommended Action	78
Severity	79
Message	79
Probable Cause	79
Recommended Action	79
Severity	79
Message	80
Probable Cause	80
Recommended Action	80
Severity	80
Message	80
Probable Cause	80
Recommended Action	80
Severity	80
Message	81
Probable Cause	81
Recommended Action	81
Severity	81
Message	81
Probable Cause	81
Recommended Action	82
Severity	82
Message	82
Probable Cause	82
Recommended Action	82
Severity	82
Message	83
Probable Cause	83
Recommended Action	83
Severity	83
Message	83
Probable Cause	83
Recommended Action	83
Severity	83
Message	84
Probable Cause	84
Recommended Action	84
Severity	84
Message	84
Probable Cause	84
Recommended Action	84
Severity	85
Message	85
Probable Cause	85
Recommended Action	85
Severity	85
Message	85
Probable Cause	85
Recommended Action	86
Severity	86
Message	86
Probable Cause	86
Recommended Action	86
Severity	86
Message	87
Probable Cause	87
Recommended Action	87
Severity	87
Message	87
Probable Cause	87
Recommended Action	87
Severity	87
Message	88
Probable Cause	88
Recommended Action	88
Severity	88
Message	88
Probable Cause	88
Recommended Action	88
Severity	88
Message	89
Probable Cause	89
Recommended Action	89
Severity	89
Message	89
Probable Cause	89
Recommended Action	89
Severity	90
Message	90
Probable Cause	90
Recommended Action	90
Severity	90
Message	91
Probable Cause	91
Recommended Action	91
Severity	91
Message	91
Probable Cause	91
Recommended Action	92
Severity	92
Message	92
Probable Cause	92
Recommended Action	92
Severity	92
Message	93
Probable Cause	93
Recommended Action	93
Severity	93
Message	93
Probable Cause	93
Recommended Action	94
Severity	94
Message	94
Probable Cause	94
Recommended Action	94
Severity	94
Message	95
Probable Cause	95
Recommended Action	95
Severity	95
Message	95
Probable Cause	95
Recommended Action	96
Severity	96
Message	96
Probable Cause	96
Recommended Action	96
Severity	96
Message	96
Probable Cause	97
Recommended Action	97
Severity	97
Message	97
Probable Cause	97
Recommended Action	97
Severity	97
Message	98
Probable Cause	98
Recommended Action	98
Severity	98
Message	98
Probable Cause	98
Recommended Action	98
Severity	99
Message	99
Probable Cause	99
Recommended Action	99
Severity	99
Message	99
Probable Cause	99
Recommended Action	100
Severity	100
Message	100
Probable Cause	100
Recommended Action	100
Severity	100
Message	101
Probable Cause	101
Recommended Action	101
Severity	101
Message	101
Probable Cause	101
Recommended Action	101
Severity	102
Message	102
Probable Cause	102
Recommended Action	102
Severity	102
Message	102
Probable Cause	102
Recommended Action	103
Severity	103
Message	103
Probable Cause	103
Recommended Action	103
Severity	103
Message	103
Probable Cause	104
Recommended Action	104
Severity	104
Message	104
Probable Cause	104
Recommended Action	104
Severity	104
Message	105
Probable Cause	105
Recommended Action	105
Severity	105
Message	105
Probable Cause	105
Recommended Action	105
Severity	105
Message	106
Probable Cause	106
Recommended Action	106
Severity	106
Message	106
Probable Cause	106
Recommended Action	106
Severity	107
Message	107
Probable Cause	107
Recommended Action	107
Severity	107
Message	108
Probable Cause	108
Recommended Action	108
Severity	108
Message	108
Probable Cause	108
Recommended Action	109
Severity	109
Message	109
Probable Cause	109
Recommended Action	109
Severity	109
Message	110
Probable Cause	110
Recommended Action	110
Severity	110
Message	110
Probable Cause	110
Recommended Action	111
Severity	111
Message	111
Probable Cause	111
Recommended Action	111
Severity	111
Message	112
Probable Cause	112
Recommended Action	113
Severity	113
Message	113
Probable Cause	113
Recommended Action	113
Severity	113
Message	114
Probable Cause	114
Recommended Action	114
Severity	114
Message	114
Probable Cause	114
Recommended Action	114
Severity	114
Message	115
Probable Cause	115
Recommended Action	115
Severity	115
Message	115
Probable Cause	115
Recommended Action	115
Severity	115
Message	116
Probable Cause	116
Recommended Action	116
Severity	116
Message	116
Probable Cause	116
Recommended Action	116
Severity	116
Message	117
Probable Cause	117
Recommended Action	117
Severity	117
Message	117
Probable Cause	117
Recommended Action	117
Severity	117
Message	118
Probable Cause	118
Recommended Action	118
Severity	118
Message	118
Probable Cause	118
Recommended Action	118
Severity	118
Message	119
Probable Cause	119
Recommended Action	119
Severity	119
Message	120
Probable Cause	120
Recommended Action	120
Severity	120
Message	120
Probable Cause	120
Recommended Action	120
Severity	120
Message	121
Probable Cause	121
Recommended Action	121
Severity	121
Message	121
Probable Cause	121
Recommended Action	121
Severity	121
Message	122
Probable Cause	122
Recommended Action	122
Severity	122
Message	122
Probable Cause	122
Recommended Action	122
Severity	122
Message	123
Probable Cause	123
Recommended Action	123
Severity	123
Message	123
Probable Cause	123
Recommended Action	123
Severity	123
Message	124
Probable Cause	124
Recommended Action	124
Severity	124
Message	124
Probable Cause	124
Recommended Action	124
Severity	124
Message	125
Probable Cause	125
Recommended Action	125
Severity	125
Message	125
Probable Cause	125
Recommended Action	125
Severity	125
Message	126
Probable Cause	126
Recommended Action	126
Severity	126
Message	126
Probable Cause	126
Recommended Action	126
Severity	126
Message	127
Probable Cause	127
Recommended Action	127
Severity	127
Message	127
Probable Cause	127
Recommended Action	127
Severity	127
Message	128
Probable Cause	128
Recommended Action	128
Severity	128
Extended fabric user guide	129
Fabric OS procedures user guide	131
Configuring Standard Security Features	131
Ensuring Network Security	131
Accessing Switches and Fabrics	132
Table 12: Access Defaults	133
Creating and Maintaining User-Defined Accounts	133
Changing an Account Password	136
Setting Up RADIUS AAA Service	136
Considerations for RADIUS Use	137
Accounting Support	138
Setting Up the RADIUS Server	138
Windows 2000	138
Linux	140
Setting Up the Switch	142
Configuring for SNMP	144
Configuring for SNMPv1	145
ISL trunking user guide	151
Long-Distance Trunking	152
Long-Distance Trunking Requirements	152
Long-Distance Trunking Summary	152
Fabric OS reference guide	153
aaaconfig	155
Syntax	155
Availability	155
Description	155
Operands	155
Example	156
agtcfgshow	157
Syntax	157
Availability	157
Description	157
Operands	158
Example	158
See Also	159
authutil	159
Syntax	159
Availability	159
Description	159
Operands	160

Match case Limit results 1 per page

Fabric OS procedures user guide

137

Fabric OS 3.x Document Addendum

To enable RADIUS service, access the CLI through an SSH connection so that the shared

secret is protected. Multiple login sessions can configure simultaneously, and the last session

to apply a change leaves its configuration in effect. After a configuration is applied, it persists

after a reboot or an HA failover.

The configuration is chassis-based, so it applies to all logical switches (domains) on the switch

and replicates itself on a standby CP card, if one is present. It is saved in a firmware upload, so

it can be applied to other switches in a firmware download. Configure at least two RADIUS

servers so that if one fails, the other assumes service. You can set the configuration with both

RADIUS service and local authentication enabled so that if all RADIUS servers do not

respond (because of power failure or network problems), the switch uses local authentication.

Considerations for RADIUS Use

Consider the following effects of the use of RADIUS service on other Fabric OS features:

■

Passwords

—

When RADIUS service is enabled, all account passwords must be managed on the

RADIUS server. The Fabric OS mechanisms for changing switch passwords remain

functional; however, such changes affect only the involved switches locally. They do

not propagate to the RADIUS server, nor do they affect any account on the RADIUS

server.

—

When RADIUS is set up for a fabric that contains a mix of switches running v4.4.0,

v3.2.x, or earlier, the way a switch authenticates users depends on whether a RADIUS

server is set up for that switch. For a switch with RADIUS support and configuration,

authentication bypasses the local password database. For a switch without RADIUS

support or configuration, authentication uses switch local account names and

passwords.

■

Secure Fabric OS. In secure mode, the following items apply:

—

Account passwords are distributed among all switches in the same fabric. An account

that resides on several switches has the same password on all of them. This model

applies with RADIUS integration; such a distribution affects only the switch local

password database.

—

There are separate admin and nonfcsadmin roles in secure mode. A nonfcsadmin

account on a RADIUS server cannot access FCS switches, even if the account is

properly authenticated.

—

If a nonfcsadmin account on a RADIUS server logs in to a switch in nonsecure mode,

the switch treats the role like the admin role and grants the access.

—

The secure Fabric OS telnet policy does not affect the operation of the RADIUS

protocol.

■

Advanced Web Tools. The following items apply:

—

Advanced Web Tools client and server keep an open session after a user is

authenticated. A password change on a switch invalidates an open session and requires

the user to log in again. When integrated with RADIUS, a switch password change on

the RADIUS server does not invalidate an existing open session. However, a password

change on the local switch does invalidate an existing open session.

—

If you cannot log in because of a RADIUS server connection problem, Advanced Web

Tools displays a message indicating server outage.