Dell Brocade 6520 Command Reference Supporting Fabric OS v7.1.0 - Page 35

Fabric OS Commands Chapter 2 aaaConfig Manages RADIUS, LDAP, and TACACS+ configuration information. SYNOPSIS aaaconfig aaaconfig --show aaaconfig --add | --change server -conf radius | ldap | tacacs+ [-p port] [-d domain] [-t timeout] [-s secret] [-a chap | pap | peap-mschapv2] aaaconfig --remove server -conf radius | ldap | tacacs+ aaaconfig --move server -conf radius | ldap | tacacs+ to_position aaaconfig --authspec aaa1[;aaa2 [-backup] [-nologout] aaaconfig --help DESCRIPTION NOTES Use this command to manage the RADIUS, LDAP, and TACACS+ server configuration for the authentication, authorization and accounting (AAA) services. Use this command to display, add, remove, change, enable or disable the RADIUS, LDAP, or TACACS+ configuration. Brocade switches use a local as well as a remote authentication mechanism for validating a login. Supported authentication protocols include Password Authentication Protocol (PAP), Challenge-Handshake Authentication Protocol (CHAP) and Protected Extensible Authentication Protocol (PEAP). In addition, Fabric OS v6.0.0 and later provides support for Light-weight Directory Access Protocol (LDAP) authentication against Active Directory for user authentication and authorization. RADIUS, LDAP or TACACS+ servers are contacted in the order they appear in the configuration list. The first server returning authentication success or failure causes the authentication request to succeed or fail. If no response is received within the specified timeout, the next RADIUS, LDAP, or TACACS+ server in the list is contacted. An event entry logs if all RADIUS, LDAP, or TACACS+ servers fail to respond. When the command succeeds, it triggers an event log (the Fabric OS error log) to indicate a server is added, removed, or modified. Refer to the Fabric OS Message Reference manual for specific details. There are two modes of operation in LDAP authentication, FIPS mode and non-FIPS mode. However, there is no option to configure LDAP while the switch is in FIPS mode. The LDAP client checks if FIPS mode is set on the switch and uses FIPS-compliant TLS ciphers for LDAP. If FIPS mode is not set and the ADir server is configured for FIPS ciphers, it uses FIPS-compliant ciphers. Configuration changes are persistently saved and take effect with the next AAA request. The configuration applies to all switch instances in a platform supporting multiple switch domains. Customers can use centralized RADIUS servers to manage AAA services for a switch, as defined in the RFC 2865 RADIUS specification. This command can be executed when logged in through the console, Telnet or SSH connection. Fabric OS Command Reference 7 53-1002746-01