Cisco Systems MDS 9000 Remote AAA Services, Remote Authentication Guidelines, Server Groups, AAA Service Configuration Options

Send documentation comments to mdsfeedback-doc@cisco.com.
27-4
Cisco MDS 9000 Family Fabric Manager Configuration Guide
OL-6965-03, Cisco MDS SAN-OS Release 2.x
Chapter 27 RADIUS and TACACS+
Authentication, Authorization, and Accounting
Remote AAA Services
Remote AAA services provided through RADIUS and TACACS+ protocols have the following
advantages over AAA servers:
•It is easier to manage user password lists for each switch in the fabric.
•AAA servers are already deployed widely across enterprises and can be easily adopted.
•Easier to manage.
•Accounting log for all switches in the fabric can be centrally managed.
•Easier to manage user role mapping for each switch in the fabric.
Remote Authentication Guidelines
When you prefer using remote AAA servers, follow these guidelines:
•A minimum of one AAA server should be IP reachable.
•Be sure to configure a desired local AAA policy as this policy is used if all AAA servers are not
reachable.
•AAA servers are easily reachable if an overlay Ethernet LAN is attached to the switch. This is the
recommended method.
•SAN networks connected to the switch should have at least one gateway switch connected to the
Ethernet LAN reaching the AAA servers.
Server Groups
You can specify remote AAA servers for authentication, authorization, and accounting using server
groups. A server group is a set of remote AAA servers implementing the same AAA protocol. The
purpose of a server group is to provide for fail-over servers in case a remote AAA server fails to respond.
If the first remote server in the group fails to respond, the next remote server in the group is tried until
one of the servers sends a response. If all the AAA servers in the server group fails to respond, then that
server group option is considered a failure. If required, you can specify multiple server groups. If the
Cisco MDS switch encounters errors from the servers in the first group, it tries the servers in the next
server group.
AAA Service Configuration Options
AAA configuration in Cisco MDS 9000 Family switches is service based. You can have separate AAA
configurations for the following services
•Telnet or SSH login (Cisco MDS Fabric Manager and Device Manager login).
•Console login.
•iSCSI authentication (see the “iSCSI User Authentication” section on page 20-17).
•FC-SP authentication (see “Fibre Channel Security Protocol” section on page 30-1).
•Accounting.