Dell PowerSwitch S5212F-ON EMC SmartFabric OS10 User Guide Release 10.5.0 - Page 988

AAA Authentication, authorization, and accounting (AAA) services secure networks against unauthorized access. In addition to local authentication, OS10 supports remote authentication dial-in user service (RADIUS) and terminal access controller access control system (TACACS+) client/server authentication systems. For RADIUS and TACACS+, an OS10 switch acts as a client and sends authentication requests to a server that contains all user authentication and network service access information. A RADIUS or TACACS+ server provides: authentication of user credentials, authorization using role-based permissions, and accounting services. You can configure the security protocol used for different login methods and users. RADIUS provides limited authorization and accounting services compared to TACACS+. If you use a RADIUS or TACACS+ security server, configure the required security parameters on the server by following the procedures in the server documentation. AAA configuration On the switch, AAA configuration consists of setting up access control and accounting services: 1. Configure the authentication methods used to allow access to the switch. 2. Configure the level of command authorization for authenticated users. 3. Configure security settings for user sessions. 4. Enable AAA accounting. AAA authentication An OS10 switch uses a list of authentication methods to define the types of authentication and the sequence in which they apply. By default, OS10 uses only the local authentication method. The authentication methods in the method list execute in the order you configure them. Re-enter the methods to change the order. The local authentication method remains enabled even if you remove all configured methods in the list using the no aaa authentication login {console | default} command. NOTE: If you configure multiple authentication methods on Dell EMC PowerEdge MX7000 Ethernet switches-MX9116n Fabric Switching Engine and MX5108n Ethernet Switch-operating in SmartFabric mode, you must configure local authentication as the first method in the list. • Configure the AAA authentication method in CONFIGURATION mode. aaa authentication login {console | default} {local | group radius | group tacacs+} ○ console-Configure authentication methods for console logins. ○ default-Configure authentication methods for nonconsole such as SSH and Telnet logins. ○ local-Use the local username, password, and role entries configured with the username password role command. ○ group radius-Configure RADIUS servers using the radius-server host command. ○ group tacacs+-Configure TACACS+ servers using the tacacs-server host command. Configure user role on server If a console user logs in with RADIUS or TACACS+ authentication, the role you configured for the user on the RADIUS or TACACS+ server applies. User authentication fails if no role is configured on the authentication server. To authenticate a user on OS10 through a TACACS+ server, configure the mandatory role with the value sysadmin along with 15 as privilege level on the TACACS+ Server. The following figure shows the Cisco ISE TACACS server configuration: 988 Security