Dell PowerSwitch S5212F-ON EMC SmartFabric OS10 User Guide Release 10.5.1 - Page 1126

= string. Valid values for Dell-group-name are sysadmin, secadmin, netadmin, and netoperator. Use the VSA Dellgroup-name values when you create users on a Radius or TACACS+ server. For detailed information about how to configure vendor-specific attributes on a RADIUS or TACACS+ server, see the respective RADIUS or TACACS+ server documentation. Configure AAA authentication OS10(config)# aaa authentication login default group radius local OS10(config)# do show running-configuration aaa aaa authentication login default group radius local aaa authentication login console local Remove AAA authentication methods OS10(config)# no aaa authentication login default OS10(config)# do show running-configuration aaa aaa authentication login default local aaa authentication login console local User re-authentication To prevent users from accessing resources and performing tasks that they are not authorized to perform, OS10 requires users to re-authenticate by logging in again when: ● Adding or removing a RADIUS server using the radius-server host command ● Adding or removing an authentication method using the aaa authentication login {console | default} {local | group radius | group tacacs+} command By default, user re-authentication is disabled. You can enable this feature so that user re-authentication is required when any of these actions are performed. In these cases, logged-in users are logged out of the switch and all OS10 sessions terminate. Enable user re-authentication ● Enable user re-authentication in CONFIGURATION mode. aaa re-authenticate enable The no version of this command disables user re-authentication. AAA with RADIUS authentication To configure a RADIUS server for authentication, enter the server IP address or hostname, and the key that is used to authenticate the OS10 switch on a RADIUS host. You can enter the authentication key in plain text or encrypted format. You can change the User Datagram Protocol (UDP) port number on the server. ● Configure a RADIUS authentication server in CONFIGURATION mode. By default, a RADIUS server uses UDP port 1812. radius-server host {hostname | ip-address} key {0 authentication-key | 9 authentication-key | authentication-key} [auth-port port-number] To configure more than one RADIUS server, re-enter the radius-server host command multiple times. If you configure multiple RADIUS servers, OS10 attempts to connect in the order you configured them. An OS10 switch connects with the configured RADIUS servers one at a time, until a RADIUS server responds with an accept or reject response. The switch tries to connect with a server for the configured number of retransmit retries and timeout period. Configure global settings for the timeout and retransmit attempts that are allowed on RADIUS servers. By default, OS10 supports three RADIUS authentication attempts and times out after five seconds. No source interface is configured. The default VRF instance is used to contact RADIUS servers. NOTE: You cannot configure both a nondefault VRF instance (including management VRF) and a source interface at the same time for RADIUS authentication. NOTE: A RADIUS server that is configured with a hostname is not supported on a nondefault VRF. 1126 Security