Home » Dell Manuals » Hubs & Switches » Dell PowerSwitch S4820T » Manual Viewer

Dell PowerSwitch S4820T Configuration Guide for the S4820T System 9.14.1.5 - Page 816

Server-Side, Re-Authentication

View all Dell PowerSwitch S4820T manuals

Add to My Manuals
Save this manual to your list of manuals

Page 816 highlights

3 Establish a host address and password. CONFIGURATION mode tacacs-server host x.x.x.x key some-password Examples of the enable commands for RADIUS To get enable authentication from the RADIUS server and use TACACS as a backup, issue the following commands. The following example shows enabling authentication from the RADIUS server. DellEMC(config)# aaa authentication enable default radius tacacs Radius and TACACS server has to be properly setup for this. DellEMC(config)# radius-server host x.x.x.x key DellEMC(config)# tacacs-server host x.x.x.x key To use local enable authentication on the console, while using remote authentication on VTY lines, run the following commands. The following example shows enabling local authentication for console and remote authentication for the VTY lines. DellEMC(config)# aaa authentication enable mymethodlist radius tacacs DellEMC(config)# line vty 0 9 DellEMC(config-line-vty)# enable authentication mymethodlist Server-Side Configuration Using AAA authentication, the switch acts as a RADIUS or TACACS+ client to send authentication requests to a TACACS+ or RADIUS server. • TACACS+ - When using TACACS+, Dell EMC Networking sends an initial packet with service type SVC_ENABLE, and then sends a second packet with just the password. The TACACS server must have an entry for username $enable$. • RADIUS - When using RADIUS authentication, the Dell OS sends an authentication packet with the following: Username: $enab15$ Password: Therefore, the RADIUS server must have an entry for this username. Configuring Re-Authentication Starting from Dell EMC Networking OS 9.11(0.0), the system enables re-authentication of user whenever there is a change in the authenticators. The change in authentication happens when: • Add or remove an authentication server (RADIUS/TACACS+) • Modify an AAA authentication/authorization list • Change to role-only (RBAC) mode The re-authentication is also applicable for authenticated 802.1x devices. When there is a change in the authetication servers, the supplicants connected to all the ports are forced to re-authenticate. 1 Enable the re-authentication mode. CONFIGURATION mode aaa reauthentication enable 2 You are prompted to force the users to re-authenticate while adding or removing a RADIUS/TACACS+ server. CONFIGURATION mode aaa authentication login method-list-name 816 Security

Section	Page
Dell Configuration Guide for the S4820T System 9.14.1.5	3
About this Guide	35
Audience	35
Conventions	35
Related Documents	35
Configuration Fundamentals	36
Accessing the Command Line	36
CLI Modes	36
Navigating CLI Modes	38
The do Command	41
Undoing Commands	41
Obtaining Help	42
Entering and Editing Commands	42
Command History	43
Filtering show Command Outputs	43
Example of the grep Keyword	43
Multiple Users in Configuration Mode	44
Getting Started	45
Console Access	46
Serial Console	46
Accessing the CLI Interface and Running Scripts Using SSH	47
Entering CLI commands Using an SSH Connection	47
Executing Local CLI Scripts Using an SSH Connection	47
Default Configuration	48
Configuring a Host Name	48
Accessing the System Remotely	48
Accessing the System Remotely	48
Configure the Management Port IP Address	48
Configure a Management Route	49
Configuring a Username and Password	49
Configuring the Enable Password	50
Configuration File Management	50
Copy Files to and from the System	51
Mounting an NFS File System	51
Save the Running-Configuration	53
Configure the Overload Bit for a Startup Scenario	54
Viewing Files	54
Managing the File System	55
Enabling Software Features on Devices Using a Command Option	55
View Command History	56
Upgrading Dell EMC Networking OS	57
Using HTTP for File Transfers	57
Verify Software Images Before Installation	58
Management	60
Configuring Privilege Levels	60
Creating a Custom Privilege Level	61
Removing a Command from EXEC Mode	61
Moving a Command from EXEC Privilege Mode to EXEC Mode	61
Allowing Access to CONFIGURATION Mode Commands	61
Allowing Access to Different Modes	61
Applying a Privilege Level to a Username	63
Applying a Privilege Level to a Terminal Line	63
Configuring Logging	63
Audit and Security Logs	64
Configuring Logging Format	66
Display the Logging Buffer and the Logging Configuration	66
Setting Up a Secure Connection to a Syslog Server	67
Log Messages in the Internal Buffer	68
Configuration Task List for System Log Management	68
Disabling System Logging	68
Sending System Messages to a Syslog Server	68
Configuring a UNIX System as a Syslog Server	69
Track Login Activity	69
Restrictions for Tracking Login Activity	69
Configuring Login Activity Tracking	69
Display Login Statistics	70
Limit Concurrent Login Sessions	71
Restrictions for Limiting the Number of Concurrent Sessions	71
Configuring Concurrent Session Limit	71
Enabling the System to Clear Existing Sessions	72
Enabling Secured CLI Mode	73
Changing System Logging Settings	73
Display the Logging Buffer and the Logging Configuration	74
Configuring a UNIX Logging Facility Level	74
Synchronizing Log Messages	75
Enabling Timestamp on Syslog Messages	76
File Transfer Services	79
Configuration Task List for File Transfer Services	79
Enabling the FTP Server	79
Configuring FTP Server Parameters	79
Configuring FTP Client Parameters	80
Terminal Lines	80
Denying and Permitting Access to a Terminal Line	81
Configuring Login Authentication for Terminal Lines	82
Setting Timeout for EXEC Privilege Mode	83
Using Telnet to get to Another Network Device	83
Lock CONFIGURATION Mode	84
Viewing the Configuration Lock Status	84
Recovering from a Forgotten Password	84
Recovering from a Forgotten Enable Password	85
Recovering from a Failed Start	86
Restoring the Factory Default Settings	87
Important Points to Remember	87
Restoring Factory Default Environment Variables	87
Dell EMC Networking OS Security Hardening	88
Dell EMC Networking OS Image Verification	89
Startup Configuration Verification	90
Configuring the root User Password	91
Locking Access to GRUB Interface	91
Enabling User Lockout for Failed Login Attempts	92
802.1X	93
Port-Authentication Process	95
EAP over RADIUS	95
Configuring 802.1X	96
Related Configuration Tasks	96
Important Points to Remember	96
Enabling 802.1X	97
Configuring MAC addresses for a do1x Profile	98
Configuring Request Identity Re-Transmissions	99
Configuring a Quiet Period after a Failed Authentication	99
Forcibly Authorizing or Unauthorizing a Port	100
Re-Authenticating a Port	101
Configuring Timeouts	102
Configuring Dynamic VLAN Assignment with Port Authentication	103
Guest and Authentication-Fail VLANs	104
Configuring a Guest VLAN	104
Configuring an Authentication-Fail VLAN	104
Configuring dot1x Profile	105
Configuring the Static MAB and MAB Profile	106
Configuring Critical VLAN	107
Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM)	108
Optimizing CAM Utilization During the Attachment of ACLs to VLANs	108
Guidelines for Configuring ACL VLAN Groups	109
Configuring ACL VLAN Groups and Configuring FP Blocks for VLAN Parameters	109
Viewing CAM Usage	111
Allocating FP Blocks for VLAN Processes	112
Access Control Lists (ACLs)	114
IP Access Control Lists (ACLs)	115
CAM Usage	116
Implementing ACLs on Dell EMC Networking OS	116
IP Fragment Handling	118
IP Fragments ACL Examples	118
Layer 4 ACL Rules Examples	119
Configure a Standard IP ACL	119
Configuring a Standard IP ACL Filter	120
Configure an Extended IP ACL	121
Configuring Filters with a Sequence Number	121
Configuring Filters Without a Sequence Number	123
Configure Layer 2 and Layer 3 ACLs	123
Assign an IP ACL to an Interface	124
Applying an IP ACL	124
Counting ACL Hits	125
Configure Ingress ACLs	125
Configure Egress ACLs	126
Applying Egress Layer 3 ACLs (Control-Plane)	127
IP Prefix Lists	127
Implementation Information	128
Configuration Task List for Prefix Lists	128
ACL Remarks	131
Configuring a Remark	131
Deleting a Remark	132
ACL Resequencing	133
Resequencing an ACL or Prefix List	133
Route Maps	134
Implementation Information	134
Important Points to Remember	135
Configuration Task List for Route Maps	135
Configuring Match Routes	137
Configuring Set Conditions	138
Configure a Route Map for Route Redistribution	139
Configure a Route Map for Route Tagging	140
Continue Clause	140
Logging of ACL Processes	141
Guidelines for Configuring ACL Logging	141
Configuring ACL Logging	142
Flow-Based Monitoring	142
Behavior of Flow-Based Monitoring	143
Enabling Flow-Based Monitoring	144
Bidirectional Forwarding Detection (BFD)	146
How BFD Works	146
BFD Packet Format	147
BFD Sessions	148
BFD Three-Way Handshake	149
Session State Changes	151
Important Points to Remember	151
Configure BFD	152
Configure BFD for Physical Ports	152
Configure BFD for Static Routes	154
Configure BFD for OSPF	156
Configure BFD for OSPFv3	160
Configure BFD for IS-IS	163
Configure BFD for BGP	165
Configure BFD for VRRP	173
Configuring Protocol Liveness	176
Troubleshooting BFD	176
Border Gateway Protocol (BGP)	178
BGP IP version 4 (BGPv4) Overview	178
BGP Autonomous Systems	178
AS4 Number Representation	180
Four-Byte AS Numbers	182
BGP router ID	182
Sessions and Peers	182
Establish a Session	183
BGP Attributes for selecting Best Path	183
Multiprotocol BGP	188
BGP global and address family configuration	189
Implement BGP with Dell EMC Networking OS	191
Configuration Information	194
Basic BGP configuration tasks	194
Prerequisite for configuring a BGP network	194
Restrictions	195
Enabling BGP	195
Enabling four-byte autonomous system numbers	197
Changing a BGP router ID	198
Configuring AS4 Number Representations	198
Configuring a BGP peer	200
Example-Configuring BGP routing between peers	201
BGP peer group	202
Advanced BGP configuration tasks	208
Route-refresh and Soft-reconfiguration	209
Aggregating Routes	211
Filtering BGP	213
Configuring BGP Fast Fall-Over	220
Configuring Passive Peering	221
Enabling Graceful Restart	222
Redistributing Routes	223
Enabling Additional Paths	224
Configuring IP Community Lists	225
Configuring an IP Extended Community List	226
Configure BGP attributes	227
Enabling Multipath	231
Route Reflectors	232
Enabling Route Flap Dampening	233
Changing BGP keepalive and hold timers	235
Setting the extended timer	236
Enabling or disabling BGP neighbors	237
Route Map Continue	238
Configuring BGP Confederations	238
Configuring a BGP VRF address family	239
Maintaining Existing AS Numbers During an AS Migration	240
Allowing an AS Number to Appear in its Own AS Path	241
Enabling MBGP Configurations	242
MBGP support for IPv6	242
Configuring IPv6 MBGP between peers	243
Example-Configuring IPv4 and IPv6 neighbors	244
Configure IPv6 NH Automatically for IPv6 Prefix Advertised over IPv4 Neighbor	246
BGP Regular Expression Optimization	248
Debugging BGP	248
Content Addressable Memory (CAM)	251
CAM Allocation	251
Test CAM Usage	253
View CAM Profiles	253
View CAM-ACL Settings	254
View CAM Usage	255
Configuring CAM Threshold and Silence Period	256
Setting CAM Threshold and Silence Period	256
CAM Optimization	257
Troubleshoot CAM Profiling	257
QoS CAM Region Limitation	257
Control Plane Policing (CoPP)	259
Configure Control Plane Policing	260
Configuring CoPP for Protocols	261
Configuring CoPP for CPU Queues	263
CoPP for OSPFv3 Packets	264
Configuring CoPP for OSPFv3	267
Displaying CoPP Configuration	267
Data Center Bridging (DCB)	270
Ethernet Enhancements in Data Center Bridging	270
Priority-Based Flow Control	271
Enhanced Transmission Selection	272
Data Center Bridging Exchange Protocol (DCBx)	273
Data Center Bridging in a Traffic Flow	274
Enabling Data Center Bridging	274
DCB Maps and its Attributes	275
Data Center Bridging: Default Configuration	276
Configuring Priority-Based Flow Control	276
Configuring Lossless Queues	277
Configuring PFC in a DCB Map	278
PFC Configuration Notes	278
PFC Prerequisites and Restrictions	279
Applying a DCB Map on a Port	279
Configuring PFC without a DCB Map	280
Configuring Lossless QueuesExample:	280
Priority-Based Flow Control Using Dynamic Buffer Method	281
Pause and Resume of Traffic	282
Buffer Sizes for Lossless or PFC Packets	282
Behavior of Tagged Packets	282
Configuration Example for DSCP and PFC Priorities	283
Using PFC to Manage Converged Ethernet Traffic	284
Configure Enhanced Transmission Selection	284
ETS Prerequisites and Restrictions	284
Creating an ETS Priority Group	284
ETS Operation with DCBx	286
Configuring Bandwidth Allocation for DCBx CIN	286
Configuring ETS in a DCB Map	287
Hierarchical Scheduling in ETS Output Policies	288
Using ETS to Manage Converged Ethernet Traffic	289
Applying DCB Policies in a Switch Stack	289
Configure a DCBx Operation	289
DCBx Operation	289
DCBx Port Roles	290
DCB Configuration Exchange	291
Configuration Source Election	291
Propagation of DCB Information	292
Auto-Detection and Manual Configuration of the DCBx Version	292
DCBx Example	293
DCBx Prerequisites and Restrictions	293
Configuring DCBx	293
Verifying the DCB Configuration	297
Sample DCB Configuration	305
PFC and ETS Configuration Command Examples	307
QoS dot1p Traffic Classification and Queue Assignment	307
Configuring the Dynamic Buffer Method	308
Dynamic Host Configuration Protocol (DHCP)	310
DHCP Packet Format and Options	310
Assign an IP Address using DHCP	312
Implementation Information	313
Configure the System to be a DHCP Server	313
Configuring the Server for Automatic Address Allocation	314
Specifying a Default Gateway	315
Configure a Method of Hostname Resolution	315
Using DNS for Address Resolution	315
Using NetBIOS WINS for Address Resolution	316
Creating Manual Binding Entries	316
Debugging the DHCP Server	316
Using DHCP Clear Commands	317
Configure the System to be a Relay Agent	317
Configure the System to be a DHCP Client	319
DHCP Client Operation with Other Features	319
DHCP Client on a Management Interface	320
Configure the System for User Port Stacking (Option 230)	321
Configuring DHCP relay source interface	321
Global DHCP relay source IPv4 or IPv6 configuration	321
Interface level DHCP relay source IPv4 or IPv6 configuration	322
Configure Secure DHCP	323
Option 82	323
DHCPv6 relay agent options	324
DHCP Snooping	324
Configuring the DHCP secondary-subnet	329
Drop DHCP Packets on Snooped VLANs Only	329
Dynamic ARP Inspection	330
Configuring Dynamic ARP Inspection	330
Source Address Validation	332
Enabling IP Source Address Validation	332
DHCP MAC Source Address Validation	333
Enabling IP+MAC Source Address Validation	333
Viewing the Number of SAV Dropped Packets	334
Clearing the Number of SAV Dropped Packets	334
Equal Cost Multi-Path (ECMP)	335
ECMP for Flow-Based Affinity	335
Configuring the Hash Algorithm	335
Enabling Deterministic ECMP Next Hop	335
Configuring the Hash Algorithm Seed	336
Link Bundle Monitoring	336
Managing ECMP Group Paths	337
Creating an ECMP Group Bundle	337
Modifying the ECMP Group Threshold	337
RTAG7	338
Flow-based Hashing for ECMP	339
FIP Snooping	342
Fibre Channel over Ethernet	342
Ensure Robustness in a Converged Ethernet Network	342
FIP Snooping on Ethernet Bridges	344
FIP Snooping in a Switch Stack	346
Using FIP Snooping	346
FIP Snooping Prerequisites	346
Important Points to Remember	346
Enabling the FCoE Transit Feature	347
Enable FIP Snooping on VLANs	348
Configure the FC-MAP Value	348
Configure a Port for a Bridge-to-Bridge Link	348
Configure a Port for a Bridge-to-FCF Link	348
Impact on Other Software Features	348
FIP Snooping Restrictions	349
Configuring FIP Snooping	349
Displaying FIP Snooping Information	350
FCoE Transit Configuration Example	355
FIPS Cryptography	357
Configuration Tasks	357
Preparing the System	357
Enabling FIPS Mode	358
Generating Host-Keys	358
Monitoring FIPS Mode Status	358
Disabling FIPS Mode	359
Force10 Resilient Ring Protocol (FRRP)	360
Protocol Overview	360
Ring Status	361
Multiple FRRP Rings	361
Important FRRP Points	362
Important FRRP Concepts	363
Implementing FRRP	364
FRRP Configuration	364
Creating the FRRP Group	364
Configuring the Control VLAN	365
Configuring and Adding the Member VLANs	366
Setting the FRRP Timers	367
Clearing the FRRP Counters	367
Viewing the FRRP Configuration	367
Viewing the FRRP Information	367
Troubleshooting FRRP	368
Configuration Checks	368
Sample Configuration and Topology	368
FRRP Support on VLT	369
Example Scenario	370
Important Points to Remember	371
GARP VLAN Registration Protocol (GVRP)	372
Important Points to Remember	372
Configure GVRP	373
Related Configuration Tasks	373
Enabling GVRP Globally	374
Enabling GVRP on a Layer 2 Interface	374
Configure GVRP Registration	374
Configure a GARP Timer	375
RPM Redundancy	375
High Availability (HA)	377
Component Redundancy	377
RPM Redundancy	377
Automatic and Manual Stack Unit Failover	379
Support for RPM Redundancy by Dell EMC Networking OS Version	380
Synchronization between Management and Standby Units	380
Configuring RPM Redundancy	380
Online Insertion and Removal	381
RPM Online Insertion and Removal	381
Linecard Online Insertion and Removal	382
Hitless Behavior	383
Graceful Restart	383
Software Resiliency	384
Software Component Health Monitoring	384
System Health Monitoring	384
Failure and Event Logging	384
Hot-Lock Behavior	385
Process Restartability	385
Enabling Process Restartability	385
Internet Group Management Protocol (IGMP)	387
IGMP Implementation Information	387
IGMP Protocol Overview	387
IGMP Version 2	387
IGMP Version 3	389
Configure IGMP	392
Related Configuration Tasks	392
Viewing IGMP Enabled Interfaces	393
Selecting an IGMP Version	393
Viewing IGMP Groups	394
Adjusting Timers	394
Adjusting Query and Response Timers	394
Enabling IGMP Immediate-Leave	395
IGMP Snooping	395
IGMP Snooping Implementation Information	395
Configuring IGMP Snooping	396
Removing a Group-Port Association	396
Disabling Multicast Flooding	397
Specifying a Port as Connected to a Multicast Router	397
Configuring the Switch as Querier	397
Fast Convergence after MSTP Topology Changes	398
Egress Interface Selection (EIS) for HTTP and IGMP Applications	398
Protocol Separation	399
Enabling and Disabling Management Egress Interface Selection	400
Handling of Management Route Configuration	400
Handling of Switch-Initiated Traffic	401
Handling of Switch-Destined Traffic	402
Handling of Transit Traffic (Traffic Separation)	402
Mapping of Management Applications and Traffic Type	402
Behavior of Various Applications for Switch-Initiated Traffic	403
Behavior of Various Applications for Switch-Destined Traffic	404
Interworking of EIS With Various Applications	405
Designating a Multicast Router Interface	406
Interfaces	407
Basic Interface Configuration	407
Advanced Interface Configuration	407
Interface Types	408
View Basic Interface Information	408
Resetting an Interface to its Factory Default State	410
Enabling Energy Efficient Ethernet	411
View EEE Information	411
Clear EEE Counters	415
Enabling a Physical Interface	416
Physical Interfaces	416
Configuration Task List for Physical Interfaces	417
Overview of Layer Modes	417
Configuring Layer 2 (Data Link) Mode	417
Configuring Layer 2 (Interface) Mode	418
Configuring Layer 3 (Network) Mode	418
Configuring Layer 3 (Interface) Mode	419
Egress Interface Selection (EIS)	419
Important Points to Remember	419
Configuring EIS	420
Management Interfaces	420
Configuring Management Interfaces	420
Configuring a Management Interface on an Ethernet Port	422
VLAN Interfaces	422
Loopback Interfaces	423
Null Interfaces	424
Port Channel Interfaces	424
Port Channel Definition and Standards	424
Port Channel Benefits	424
Port Channel Implementation	424
Interfaces in Port Channels	425
Configuration Tasks for Port Channel Interfaces	425
Creating a Port Channel	426
Adding a Physical Interface to a Port Channel	426
Reassigning an Interface to a New Port Channel	428
Configuring the Minimum Oper Up Links in a Port Channel	428
Adding or Removing a Port Channel from a VLAN	429
Assigning an IP Address to a Port Channel	430
Deleting or Disabling a Port Channel	430
Load Balancing Through Port Channels	430
Changing the Hash Algorithm	431
Bulk Configuration	432
Interface Range	432
Bulk Configuration Examples	432

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173

Match case Limit results 1 per page

Establish a host address and password.

CONFIGURATION mode

tacacs-server host x.x.x.x key some-password

Examples of the

enable

commands for RADIUS

To get

enable authentication

from the RADIUS server and use TACACS as a backup, issue the following commands.

The following example shows enabling authentication from the RADIUS server.

DellEMC(config)# aaa authentication enable default radius tacacs

Radius and TACACS server has to be properly setup for this.

DellEMC(config)# radius-server host x.x.x.x key <some-password>

DellEMC(config)# tacacs-server host x.x.x.x key <some-password>

To use local enable authentication on the console, while using remote authentication on VTY lines, run the following commands.

The following example shows enabling local authentication for console and remote authentication for the VTY lines.

DellEMC(config)# aaa authentication enable mymethodlist radius tacacs

DellEMC(config)# line vty 0 9

DellEMC(config-line-vty)# enable authentication mymethodlist

Server-Side

Conﬁguration

Using AAA authentication, the switch acts as a RADIUS or TACACS+ client to send authentication requests to a TACACS+ or RADIUS

server.

•

TACACS+

— When using TACACS+, Dell EMC Networking sends an initial packet with service type SVC_ENABLE, and then sends a

second packet with just the password. The TACACS server must have an entry for username $enable$.

•

RADIUS

— When using RADIUS authentication, the Dell OS sends an authentication packet with the following:

Username: $enab15$

Password: <password-entered-by-user>

Therefore, the RADIUS server must have an entry for this username.

Conﬁguring

Re-Authentication

Starting from Dell EMC Networking OS 9.11(0.0), the system enables re-authentication of user whenever there is a change in the

authenticators.

The change in authentication happens when:

•

Add or remove an authentication server (RADIUS/TACACS+)

•

Modify an AAA authentication/authorization list

•

Change to role-only (RBAC) mode

The re-authentication is also applicable for authenticated 802.1x devices. When there is a change in the authetication servers, the

supplicants connected to all the ports are forced to re-authenticate.

Enable the re-authentication mode.

CONFIGURATION mode

aaa reauthentication enable

You are prompted to force the users to re-authenticate while adding or removing a RADIUS/TACACS+ server.

CONFIGURATION mode

aaa authentication login

method-list-name

816

Security