Dell Brocade G620 Brocade 8.0.1 Fabric OS Command Reference - Page 29

Fabric OS Commands aaaConfig Manages RADIUS, LDAP, and TACACS+ configuration information. Synopsis aaaconfig aaaconfig --show aaaconfig --add | --change server -conf radius | ldap | tacacs+ [-p port] [-d domain] [-t timeout] [-s secret] [-a chap | pap | peap-mschapv2] [-e encr_type] aaaconfig --remove server -conf radius | ldap | tacacs+ aaaconfig --move server -conf radius | ldap | tacacs+ to_position aaaconfig --authspec aaa1[;aaa2 [-backup] [-nologout] aaaconfig --help Description Use this command to manage the RADIUS, LDAP, and TACACS+ server configuration for the authentication, authorization and accounting (AAA) services. Use this command to display, add, remove, change, enable or disable the RADIUS, LDAP, or TACACS+ configuration. Brocade switches use a local as well as a remote authentication mechanism for validating a login. Supported authentication protocols include Password Authentication Protocol (PAP), Challenge-Handshake Authentication Protocol (CHAP) and Protected Extensible Authentication Protocol (PEAP). Light-weight Directory Access Protocol (LDAP) authentication against Active Directory for user authentication and authorization is supported. RADIUS, LDAP or TACACS+ servers are contacted in the order they appear in the configuration list. The first server returning authentication success or failure causes the authentication request to succeed or fail. If no response is received within the specified timeout, the next RADIUS, LDAP, or TACACS+ server in the list is contacted. An event entry logs if all RADIUS, LDAP, or TACACS+ servers fail to respond. When the command succeeds, it triggers an event log (the Fabric OS error log) to indicate a server is added, removed, or modified. Refer to the Fabric OS Message Reference manual for specific details. There are two modes of operation in LDAP authentication, FIPS mode and non-FIPS mode. However, there is no option to configure LDAP while the switch is in FIPS mode. The LDAP client checks if FIPS mode is set on the switch and uses FIPS-compliant TLS ciphers for LDAP. If FIPS mode is not set and the ADir server is configured for FIPS ciphers, it uses FIPS-compliant ciphers. Configuration changes are persistently saved and take effect with the next AAA request. The configuration applies to all switch instances in a platform supporting multiple switch domains. Brocade Fabric OS Command Reference 5 53-1004112-02