HP GbE2c HP GbE2c Ethernet Blade Switch for c-Class BladeSystem User Guide - Page 12

Radius, Tacacs

Get HP GbE2c - Blc Layer 2/3 Fiber SFP Option PDF manuals and user guides
UPC - 808736802215
View all HP GbE2c manuals
Add to My Manuals
Save this manual to your list of manuals

Page 12 highlights

configurable from the browser-based interface, but because the connection is based on an IP address for these interfaces, users will have to reconnect with the newly assigned IP address. NTP The switch maintains the current date and time. This information displays on the management interfaces and is used to record the date and time of switch events. Current date and time information are manually set on the switch or are obtained through NTP. NTP allows the switch to send a request to a primary NTP server in each polling period asking for GMT. RADIUS The switch supports the RADIUS method to authenticate and authorize remote administrators for managing the switch. This method is based on a client/server model. The RAS, the switch, is a client to the back-end database server. A remote user (the remote administrator) interacts only with the RAS, not the back-end server and database. RADIUS authentication consists of: • A protocol with a frame format that utilizes UDP over IP, based on RFC 2138 and 2866 • A centralized server that stores all the user authorization information • A client, in this case, the switch The switch, acting as the RADIUS client, communicates to the RADIUS server to authenticate and authorize a remote administrator using the protocol definitions specified in RFC 2138 and 2866. Transactions between the client and the RADIUS server are authenticated using a shared key that is not sent over the network. In addition, the remote administrator passwords are sent encrypted between the RADIUS client (the switch) and the back-end RADIUS server. The benefits of using RADIUS are: • Authentication of remote administrators • Identification of the administrator using name/password • Authorization of remote administrators • Determination of the permitted actions and customizing service for individual administrators TACACS+ The switch supports the TACACS+ method to authenticate, authorize, and account for remote administrators managing the switch. This method is based on a client/server model. The switch is a client to the back-end TACACS+ AAA server. A remote user (the remote administrator) interacts only with the client, and not with the back end AAA server. The TACACS+ AAA method consists of: • A protocol with a frame format that utilizes TCP over IP • A centralized AAA server that stores all the user authentication, authorization, and accounting (of usage) information • A NAS or client (in this case, the switch) The switch, acting as the TACACS+ client or NAS, communicates to the TACACS+ server to authenticate, authorize, and account for user access. Transactions between the client and the TACACS+ server are authenticated using a shared key that is not sent over the network. In addition, the remote administrator passwords are sent encrypted between the TACACS+ client (the switch) and the back-end TACACS+ server. The switch supports: Introduction 12

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
Introduction 12
configurable from the browser-based interface, but because the connection is based on an IP address for
these interfaces, users will have to reconnect with the newly assigned IP address.
NTP
The switch maintains the current date and time. This information displays on the management interfaces
and is used to record the date and time of switch events. Current date and time information are manually
set on the switch or are obtained through NTP. NTP allows the switch to send a request to a primary NTP
server in each polling period asking for GMT.
RADIUS
The switch supports the RADIUS method to authenticate and authorize remote administrators for managing
the switch. This method is based on a client/server model. The RAS, the switch, is a client to the back-end
database server. A remote user (the remote administrator) interacts only with the RAS, not the back-end
server and database.
RADIUS authentication consists of:
•
A protocol with a frame format that utilizes UDP over IP, based on RFC 2138 and 2866
•
A centralized server that stores all the user authorization information
•
A client, in this case, the switch
The switch, acting as the RADIUS client, communicates to the RADIUS server to authenticate and authorize
a remote administrator using the protocol definitions specified in RFC 2138 and 2866. Transactions
between the client and the RADIUS server are authenticated using a shared key that is not sent over the
network. In addition, the remote administrator passwords are sent encrypted between the RADIUS client
(the switch) and the back-end RADIUS server.
The benefits of using RADIUS are:
•
Authentication of remote administrators
•
Identification of the administrator using name/password
•
Authorization of remote administrators
•
Determination of the permitted actions and customizing service for individual administrators
TACACS+
The switch supports the TACACS+ method to authenticate, authorize, and account for remote
administrators managing the switch. This method is based on a client/server model. The switch is a client
to the back-end TACACS+ AAA server. A remote user (the remote administrator) interacts only with the
client, and not with the back end AAA server.
The TACACS+ AAA method consists of:
•
A protocol with a frame format that utilizes TCP over IP
•
A centralized AAA server that stores all the user authentication, authorization, and accounting (of
usage) information
•
A NAS or client (in this case, the switch)
The switch, acting as the TACACS+ client or NAS, communicates to the TACACS+ server to authenticate,
authorize, and account for user access. Transactions between the client and the TACACS+ server are
authenticated using a shared key that is not sent over the network. In addition, the remote administrator
passwords are sent encrypted between the TACACS+ client (the switch) and the back-end TACACS+
server.
The switch supports: