Brocade Communications Systems manual Brocade ICX 6650 Security Configuration Guide

Passwords used to secure access . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Setting a Telnet password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Setting passwords for management privilege levels . . . . . . . . . 14 Recovering from a lost password . . . . . . . . . . . . . . . . . . . . . . . . 16 Displaying the SNMP community string . . . . . . . . . . . . . . . . . . . 16 Specifying a minimum password length. . . . . . . . . . . . . . . . . . . 16

Local user accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Enhancements to username and password . . . . . . . . . . . . . . . 17 Local user account configuration . . . . . . . . . . . . . . . . . . . . . . . . 21 Creating a password option. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Changing a local user password . . . . . . . . . . . . . . . . . . . . . . . . . 24

TACACS and TACACS+ security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 How TACACS+ differs from TACACS . . . . . . . . . . . . . . . . . . . . . . . 24 TACACS/TACACS+ authentication, authorization,

and accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 TACACS authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 TACACS/TACACS+ configuration considerations . . . . . . . . . . . . 30 Enabling TACACS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Identifying the TACACS/TACACS+ servers. . . . . . . . . . . . . . . . . . 31 Specifying different servers for individual AAA functions . . . . . 32 Setting optional TACACS and TACACS+ parameters . . . . . . . . . 32 Configuring authentication-method lists for

TACACS and TACACS+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Configuring TACACS+ authorization . . . . . . . . . . . . . . . . . . . . . . 36 TACACS+ accounting configuration. . . . . . . . . . . . . . . . . . . . . . . 39 Configuring an interface as the source for all

TACACS and TACACS+ packets . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Displaying TACACS/TACACS+ statistics and

configuration information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

RADIUS security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 RADIUS authentication, authorization, and accounting . . . . . . 41 RADIUS configuration considerations. . . . . . . . . . . . . . . . . . . . .44 Configuring RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Brocade-specific attributes on the RADIUS server . . . . . . . . . . 45 Enabling SNMP to configure RADIUS . . . . . . . . . . . . . . . . . . . . . 47 Identifying the RADIUS server to the Brocade device . . . . . . . . 47 Specifying different servers for individual AAA functions . . . . . 48 RADIUS server per port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 RADIUS server to individual ports mapping . . . . . . . . . . . . . . . . 49 RADIUS parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Setting authentication-method lists for RADIUS . . . . . . . . . . . . 51 RADIUS authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 RADIUS accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Configuring an interface as the source for all

RADIUS packets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Displaying RADIUS configuration information . . . . . . . . . . . . . . 56

Authentication-method lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Examples of authentication-method lists. . . . . . . . . . . . . . . . . . 58

TCP Flags - edge port security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Using TCP Flags in combination with other ACL features . . . . . 61

iv	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01