Brocade Communications Systems 53-1001763-02 사용자 설명서
114
Fabric OS Administrator’s Guide
53-1001763-02
The authentication model using RADIUS and LDAP
5
Authentication servers on the switch
At least one RADIUS or LDAP server must be configured before you can enable RADIUS or LDAP
service. You can configure the RADIUS or LDAP service even if it is disabled on the switch. You can
configure up to five RADIUS or LDAP servers. You must be logged in as admin or switchAdmin to
configure the RADIUS service.
service. You can configure the RADIUS or LDAP service even if it is disabled on the switch. You can
configure up to five RADIUS or LDAP servers. You must be logged in as admin or switchAdmin to
configure the RADIUS service.
NOTE
On dual-CP enterprise-class platforms (Brocade 48000, Brocade DCX and DCX-4S backbones), the
switch sends its RADIUS or LDAP request using the IP address of the active CP. When adding clients,
add both the active and standby CP IP addresses so that users can still log in to the switch in the
event of a failover.
On dual-CP enterprise-class platforms (Brocade 48000, Brocade DCX and DCX-4S backbones), the
switch sends its RADIUS or LDAP request using the IP address of the active CP. When adding clients,
add both the active and standby CP IP addresses so that users can still log in to the switch in the
event of a failover.
RADIUS or LDAP configuration is chassis-based configuration data. On platforms containing
multiple switch instances, the configuration applies to all instances. The configuration is persistent
across reboots and firmware downloads. On a chassis-based system, the command must replicate
the configuration to the standby CP.
multiple switch instances, the configuration applies to all instances. The configuration is persistent
across reboots and firmware downloads. On a chassis-based system, the command must replicate
the configuration to the standby CP.
Multiple login sessions can invoke the command simultaneously. The last session that applies the
change is the one whose configuration is in effect. This configuration is persistent after an HA
failover.
change is the one whose configuration is in effect. This configuration is persistent after an HA
failover.
The RADIUS or LDAP servers are contacted in the order they are listed, starting from the top of the
list and moving to the bottom.
list and moving to the bottom.
Adding a RADIUS or LDAP server to the switch configuration
1. Connect to the switch and log in using an account assigned to the admin role.
2. Enter the aaaConfig
--
add command.
At least one RADIUS or LDAP server must be configured before you can enable the RADIUS or LDAP
service.
service.
If no RADIUS or LDAP configuration exists, turning on the RADIUS authentication mode triggers an
error message. When the command succeeds, the event log indicates that the configuration is
enabled or disabled.
error message. When the command succeeds, the event log indicates that the configuration is
enabled or disabled.
Enabling and disabling a RADIUS or LDAP server
1. Connect to the switch and log in using an account assigned to the admin role.
2. Enter the aaaConfig
--
authspec
command to enable RADIUS or LDAP using the local
database.
You must specify the type of server as either RADIUS or LDAP, but not both. Local is used for
local authentication if the user authentication fails on the RADIUS or LDAP server.
local authentication if the user authentication fails on the RADIUS or LDAP server.
Example of enabling RADIUS
switch:admin> aaaconfig --authspec "radius;local" --backup
Deleting a RADIUS or LDAP server from the configuration
1. Connect to the switch and log in using an account assigned to the admin role.
2. Enter the aaaConfig
--
remove
command.
When the command succeeds, the event log indicates that the server is removed.