Home » HP Manuals » Storage Devices » HP StorageWorks MSA 2/8 » Manual Viewer

HP StorageWorks MSA 2/8 HP StorageWorks Fabric OS 3.X Document Addendum (AA-RW - Page 138

Accounting Support, Setting Up the RADIUS Server, Windows 2000, Start

View all HP StorageWorks MSA 2/8 manuals

Add to My Manuals
Save this manual to your list of manuals

Page 138 highlights

Fabric OS procedures user guide ■ API. The following items apply: - When an older version of the API host library authenticates against a switch with RADIUS support, the host performs the login. However, the old host library does not recognize the role returned from the switch, which can result in the host displaying an incorrect read or write attribute for an account. The switch library performs the permission check again for individual API function calls. - API provides functions for RADIUS configuration that share the behavior of the aaaconfig CLI command. ■ Advanced Web Tools and API. The following items apply to both of these features: - Users can log in using account names and passwords configured on the RADIUS server, and gain access with the switch roles defined on the RADIUS server. - Users can log in through API using account names and passwords configured on the RADIUS server, and gain access with the switch roles defined on the RADIUS server. - When a proxy switch is used, the switch-side component performs authentication on the proxy switch, rather than on the destination switch. Therefore, to use RADIUS in this environment, you must configure on the proxy switch. Accounting Support The RADIUS service supports accounting request and response packets so that accounting records can be centralized on the RADIUS server. The login account name, assigned role, and password are stored on the RADIUS server for each user. Setting Up the RADIUS Server You must know the switch IP address or name to connect to switches. Use the ipaddrshow command to display a switch IP address. User accounts should be set up by their true network-wide identity, rather than by the account names created on a Fabric OS switch. Along with each account name, the administrator should assign appropriate switch access roles. To manage a nonsecure fabric, these roles can be user or admin. To manage a secure fabric, these roles can be user, admin, or nonfcsadmin. When they log in to a switch configured with RADIUS, users enter their assigned RADIUS account names and passwords at the prompt. After the RADIUS server authenticates a user, it responds with the assigned switch role in an HP Vendor-Specific Attribute (VSA) as defined in the RFC. An authentication-accept response without such VSA role assignment grants the user role. The following sections explain how to configure a RADIUS server to support HP clients under different operating systems. Windows 2000 Use these procedures to add a client to the RADIUS server and create remote access policies for Fabric OS user and admin roles. To add a RADIUS client: 1. From the Windows Start menu, select Programs > Administrative Tools:Internet Authentication Service. 2. In the Internet Authentication Service window, right-click the RADIUS Clients folder and select New RADIUS Client. 138 Fabric OS 3.x Document Addendum

Section	Page
Contents	3
About this Guide	9
Overview	10
Intended audience	10
Related documentation	10
Conventions	11
Document conventions	11
Table 1: Document conventions	11
Text symbols	11
Getting help	12
HP technical support	12
HP storage web site	12
HP authorized reseller	12
Advanced performance monitor user guide	13
ISL Monitoring	13
Using ISL Monitoring	14
Displaying ISL Monitors	14
Clearing ISL Monitors	15
Advanced Web Tools user guide	17
Figure 1: Port information view	18
Table 2: Supported platforms	18
Configuring the Web Browser	19
Configuring Internet Explorer	19
Configuring Mozilla	19
Installing the Java Plug-in on Windows XP, 2000, or NT	20
Installing the Java Plug-in on Windows XP, 2000, or 2003	20
Two and Four Domain Fabric Licensing	20
Figure 2: Switch status window	21
Figure 3: Switch status window, port detail	22
Figure 4: Switch events window	23
Filtering Switch Events	23
Figure 5: Event filter dialog box	24
Filtering Events by Time Intervals	24
Filtering Events by Event Severity	24
Figure 6: Switch Information Tab	26
Figure 7: Network Configuration Tab	27
About the Firmware Tab	28
Firmware Tab Example	28
Figure 8: Firmware Tab	28
Firmware Field Descriptions	29
Table 3: Firmware field descriptions	29
Using the Upload/Download Tab	29
Using the Firmware Tab	29
Performing a Fast Boot	30
Performing a Reboot	30
Figure 9: SNMP Tab (Secure Mode disabled)	31
Figure 10: License Admin Tab	33
Figure 11: Port Setting Tab	35
Figure 12: Configure (Fabric) Tab	37
Figure 13: Configure (Virtual Channel) Tab	39
Figure 14: Configure (Arbitrated Loop) Tab	40
Figure 15: Configure (System) Tab	41
Configure (Upload/Download) Tab Example	42
Figure 16: Configure (Upload/Download) Tab	42
Configure (Upload/Download) Field Descriptions	42
Table 4: Configure (Upload/Download) Field Descriptions	43
Backing Up a Switch Config File	43
Performing a Config Download to a Switch	43
Figure 17: Routing (FSPF Route) Tab	44
Figure 18: Routing (Static Route) Tab	45
Figure 19: Routing (Link Cost) Tab	46
Extended Fabric Tab Example	47
Figure 20: Extended Fabric Tab	47
AAA Service Tab Example	49
Figure 21: AAA Service Tab	49
AAA Service Tab Field Descriptions	50
Table 5: AAA Service Tab Field Descriptions	50
Enabling and Disabling the RADIUS Server	50
Configuring the RADIUS Server	50
Modifying the RADIUS Server	51
Modifying the RADIUS Server Order	51
Removing a RADIUS Server	52
Figure 22: Trunk Information Tab	52
Figure 23: Alarm Notification Tab	53
Figure 24: Threshold Configuration Area Configuration Tab	54
Table 6: Threshold Configuration Tab Components	55
Trait Configuration Tab	55
Table 7: Trait Configuration Components	55
Alarm Configuration Tab	56
Table 8: Alarm Configuration Components	56
Figure 25: Email Configuration Tab	56
Table 9: Email Configuration Field Descriptions	58
Figure 26: The Fabric Events Window	59
Filtering Fabric Events	59
Filtering Events by Time Intervals	59
Filtering Events by Event Severity	60
Figure 27: Name Server Table Window	61
Table 10: Name Server Description of Columns	62
Displaying Name Server Information for a Device	62
Displaying Zone Members of a Device	63
Figure 28: Device Detail View Example	64
Viewing Detailed Information About the Enabled Zone Configuration	64
Figure 29: Alias Tab	67
Figure 30: Zone Tab	68
Figure 31: Fabric Assist Tab	69
Figure 32: Config Tab	70
Displaying an Initiator/Target Accessibility	71
Zoning version user guide	73
Table 11: Zoning Database Limitations	74
Diagnostic and system error messages reference guide	75
Message	75
Probable Cause	75
Recommended Action	75
Severity	75
Message	76
Probable Cause	76
Recommended Action	76
Severity	76
Message	76
Probable Cause	76
Recommended Action	76
Severity	76
Message	77
Probable Cause	77
Recommended Action	77
Severity	77
Message	77
Probable Cause	77
Recommended Action	77
Severity	77
Message	78
Probable Cause	78
Recommended Action	78
Severity	79
Message	79
Probable Cause	79
Recommended Action	79
Severity	79
Message	80
Probable Cause	80
Recommended Action	80
Severity	80
Message	80
Probable Cause	80
Recommended Action	80
Severity	80
Message	81
Probable Cause	81
Recommended Action	81
Severity	81
Message	81
Probable Cause	81
Recommended Action	82
Severity	82
Message	82
Probable Cause	82
Recommended Action	82
Severity	82
Message	83
Probable Cause	83
Recommended Action	83
Severity	83
Message	83
Probable Cause	83
Recommended Action	83
Severity	83
Message	84
Probable Cause	84
Recommended Action	84
Severity	84
Message	84
Probable Cause	84
Recommended Action	84
Severity	85
Message	85
Probable Cause	85
Recommended Action	85
Severity	85
Message	85
Probable Cause	85
Recommended Action	86
Severity	86
Message	86
Probable Cause	86
Recommended Action	86
Severity	86
Message	87
Probable Cause	87
Recommended Action	87
Severity	87
Message	87
Probable Cause	87
Recommended Action	87
Severity	87
Message	88
Probable Cause	88
Recommended Action	88
Severity	88
Message	88
Probable Cause	88
Recommended Action	88
Severity	88
Message	89
Probable Cause	89
Recommended Action	89
Severity	89
Message	89
Probable Cause	89
Recommended Action	89
Severity	90
Message	90
Probable Cause	90
Recommended Action	90
Severity	90
Message	91
Probable Cause	91
Recommended Action	91
Severity	91
Message	91
Probable Cause	91
Recommended Action	92
Severity	92
Message	92
Probable Cause	92
Recommended Action	92
Severity	92
Message	93
Probable Cause	93
Recommended Action	93
Severity	93
Message	93
Probable Cause	93
Recommended Action	94
Severity	94
Message	94
Probable Cause	94
Recommended Action	94
Severity	94
Message	95
Probable Cause	95
Recommended Action	95
Severity	95
Message	95
Probable Cause	95
Recommended Action	96
Severity	96
Message	96
Probable Cause	96
Recommended Action	96
Severity	96
Message	96
Probable Cause	97
Recommended Action	97
Severity	97
Message	97
Probable Cause	97
Recommended Action	97
Severity	97
Message	98
Probable Cause	98
Recommended Action	98
Severity	98
Message	98
Probable Cause	98
Recommended Action	98
Severity	99
Message	99
Probable Cause	99
Recommended Action	99
Severity	99
Message	99
Probable Cause	99
Recommended Action	100
Severity	100
Message	100
Probable Cause	100
Recommended Action	100
Severity	100
Message	101
Probable Cause	101
Recommended Action	101
Severity	101
Message	101
Probable Cause	101
Recommended Action	101
Severity	102
Message	102
Probable Cause	102
Recommended Action	102
Severity	102
Message	102
Probable Cause	102
Recommended Action	103
Severity	103
Message	103
Probable Cause	103
Recommended Action	103
Severity	103
Message	103
Probable Cause	104
Recommended Action	104
Severity	104
Message	104
Probable Cause	104
Recommended Action	104
Severity	104
Message	105
Probable Cause	105
Recommended Action	105
Severity	105
Message	105
Probable Cause	105
Recommended Action	105
Severity	105
Message	106
Probable Cause	106
Recommended Action	106
Severity	106
Message	106
Probable Cause	106
Recommended Action	106
Severity	107
Message	107
Probable Cause	107
Recommended Action	107
Severity	107
Message	108
Probable Cause	108
Recommended Action	108
Severity	108
Message	108
Probable Cause	108
Recommended Action	109
Severity	109
Message	109
Probable Cause	109
Recommended Action	109
Severity	109
Message	110
Probable Cause	110
Recommended Action	110
Severity	110
Message	110
Probable Cause	110
Recommended Action	111
Severity	111
Message	111
Probable Cause	111
Recommended Action	111
Severity	111
Message	112
Probable Cause	112
Recommended Action	113
Severity	113
Message	113
Probable Cause	113
Recommended Action	113
Severity	113
Message	114
Probable Cause	114
Recommended Action	114
Severity	114
Message	114
Probable Cause	114
Recommended Action	114
Severity	114
Message	115
Probable Cause	115
Recommended Action	115
Severity	115
Message	115
Probable Cause	115
Recommended Action	115
Severity	115
Message	116
Probable Cause	116
Recommended Action	116
Severity	116
Message	116
Probable Cause	116
Recommended Action	116
Severity	116
Message	117
Probable Cause	117
Recommended Action	117
Severity	117
Message	117
Probable Cause	117
Recommended Action	117
Severity	117
Message	118
Probable Cause	118
Recommended Action	118
Severity	118
Message	118
Probable Cause	118
Recommended Action	118
Severity	118
Message	119
Probable Cause	119
Recommended Action	119
Severity	119
Message	120
Probable Cause	120
Recommended Action	120
Severity	120
Message	120
Probable Cause	120
Recommended Action	120
Severity	120
Message	121
Probable Cause	121
Recommended Action	121
Severity	121
Message	121
Probable Cause	121
Recommended Action	121
Severity	121
Message	122
Probable Cause	122
Recommended Action	122
Severity	122
Message	122
Probable Cause	122
Recommended Action	122
Severity	122
Message	123
Probable Cause	123
Recommended Action	123
Severity	123
Message	123
Probable Cause	123
Recommended Action	123
Severity	123
Message	124
Probable Cause	124
Recommended Action	124
Severity	124
Message	124
Probable Cause	124
Recommended Action	124
Severity	124
Message	125
Probable Cause	125
Recommended Action	125
Severity	125
Message	125
Probable Cause	125
Recommended Action	125
Severity	125
Message	126
Probable Cause	126
Recommended Action	126
Severity	126
Message	126
Probable Cause	126
Recommended Action	126
Severity	126
Message	127
Probable Cause	127
Recommended Action	127
Severity	127
Message	127
Probable Cause	127
Recommended Action	127
Severity	127
Message	128
Probable Cause	128
Recommended Action	128
Severity	128
Extended fabric user guide	129
Fabric OS procedures user guide	131
Configuring Standard Security Features	131
Ensuring Network Security	131
Accessing Switches and Fabrics	132
Table 12: Access Defaults	133
Creating and Maintaining User-Defined Accounts	133
Changing an Account Password	136
Setting Up RADIUS AAA Service	136
Considerations for RADIUS Use	137
Accounting Support	138
Setting Up the RADIUS Server	138
Windows 2000	138
Linux	140
Setting Up the Switch	142
Configuring for SNMP	144
Configuring for SNMPv1	145
ISL trunking user guide	151
Long-Distance Trunking	152
Long-Distance Trunking Requirements	152
Long-Distance Trunking Summary	152
Fabric OS reference guide	153
aaaconfig	155
Syntax	155
Availability	155
Description	155
Operands	155
Example	156
agtcfgshow	157
Syntax	157
Availability	157
Description	157
Operands	158
Example	158
See Also	159
authutil	159
Syntax	159
Availability	159
Description	159
Operands	160

Match case Limit results 1 per page

Fabric OS procedures user guide

138

Fabric OS 3.x Document Addendum

■

API. The following items apply:

—

When an older version of the API host library authenticates against a switch with

RADIUS support, the host performs the login. However, the old host library does not

recognize the role returned from the switch, which can result in the host displaying an

incorrect read or write attribute for an account. The switch library performs the

permission check again for individual API function calls.

—

API provides functions for RADIUS configuration that share the behavior of the

aaaconfig

CLI command.

■

Advanced Web Tools

and

API. The following items apply to both of these features:

—

Users can log in using account names and passwords configured on the RADIUS

server, and gain access with the switch roles defined on the RADIUS server.

—

Users can log in through API using account names and passwords configured on the

RADIUS server, and gain access with the switch roles defined on the RADIUS server.

—

When a proxy switch is used, the switch-side component performs authentication on

the proxy switch, rather than on the destination switch. Therefore, to use RADIUS in

this environment, you must configure on the proxy switch.

Accounting Support

The RADIUS service supports accounting request and response packets so that accounting

records can be centralized on the RADIUS server. The login account name, assigned role, and

password are stored on the RADIUS server for each user.

Setting Up the RADIUS Server

You must know the switch IP address or name to connect to switches. Use the

ipaddrshow

command to display a switch IP address.

User accounts should be set up by their true network-wide identity, rather than by the account

names created on a Fabric OS switch. Along with each account name, the administrator should

assign appropriate switch access roles. To manage a nonsecure fabric, these roles can be user

or admin. To manage a secure fabric, these roles can be user, admin, or nonfcsadmin.

When they log in to a switch configured with RADIUS, users enter their assigned RADIUS

account names and passwords at the prompt. After the RADIUS server authenticates a user, it

responds with the assigned switch role in an HP Vendor-Specific Attribute (VSA) as defined in

the RFC. An authentication-accept response without such VSA role assignment grants the user

role.

The following sections explain how to configure a RADIUS server to support HP clients under

different operating systems.

Windows 2000

Use these procedures to add a client to the RADIUS server and create remote access policies

for Fabric OS user and admin roles.

To add a RADIUS client:

From the Windows

Start

menu, select

Programs > Administrative Tools:Internet

Authentication Service

In the Internet Authentication Service window, right-click the

RADIUS Clients

folder and

select

New RADIUS Client