Dell N3200-ON Networking N-Series Switches CLI Reference Guide version 6.8.0 - Page 280

• The password is saved internally in encrypted format and never appears in clear text anywhere on the CLI. • The CLI supports TACACS+ and RADIUS authentication servers and RADIUS accounting servers. • The CLI allows the administrator to configure primary and secondary authentication servers. If the primary authentication server fails to respond within a configurable period, the CLI automatically tries the secondary authentication server. • The administrator can specify whether the CLI should revert to using local accounts when the remote authentication servers do not respond or if the CLI simply fails the login attempt because the authentication servers are down. This capability applies only when the administrator is logged in through a telnet or an SSH session. • The CLI always allows the administrator to log in to a local serial port even if the remote authentication server(s) are down. In this case, CLI reverts to using the locally configured accounts to allow the administrator to log in. User Access Control In addition to authenticating an administrator, the CLI also assigns the administrator access to one of two security levels. Privilege level 1 has readonly access. This level allows the administrator to read information but not configure the switch. The access to this level cannot be modified. Level 15 is the special access level assigned to the superuser of the switch. This level has full access to all functions within the switch. If the account is created and maintained locally, each account is given an access level at the time of account creation. If the administrator is authenticated through remote authentication servers, the authentication server is configured to pass the access level to the CLI when the account is authenticated. When RADIUS is used, the Vendor-Specific Option field returns the access level. Two vendor specific options are supported. These are CISCO-AV-Pairs(Shell:priv-lvl=x) and Dell RADIUS VSA (user-group=x). TACACS+ provides the appropriate level of access. The following rules and specifications apply: • The administrator determines whether remote authentication servers or locally defined authentication accounts are used. Using the CLI 280