Send documentation comments to mdsfeedback-doc@cisco.com.
27-11
Cisco MDS 9000 Family Fabric Manager Configuration Guide
OL-6965-03, Cisco MDS SAN-OS Release 2.x
Chapter 27 RADIUS and TACACS+
Configuring Server Groups
Step 4 Select the radius radio button to add a RADIUS server group or select tacacs+ to add a TACACS+ server
group.
Step 5 Check the servers from the ServerIdList for the servers you want to be part of this server group.
Step 6 Click Create to create this RADIUS server or click Close to exit the dialog box without creating the new
server.

Distributing AAA server Configuration

Configuration for RADIUS and TACACS+ AAA on a switch running Cisco MDS SAN-OS can be
distributed using the Cisco Fabric Services (CFS). The distribution is disabled by default.
After enabling the distribution, the first server or global configuration starts an implicit session. All
server configuration commands entered there after are stored in a temporary database and applied to all
switches in the fabric (including the originating one) when you explicitly commit the database. The
various server and global parameters are distributed, except the server and global keys. These keys are
unique secrets to a switch and should not be shared with other switches.
Note Server group configurations are not distributed.

Enabling the distribution

Only switches where distribution is enabled can participate in the distribution activity.
To enable a RADIUS or TACACS+ CFS distribution using Fabric Manager, follow these steps:
Step 1 Choose Switches > Security > AAA > RADIUS or choose Switches > Security > AAA > TACACS+.
You see the RADIUS or TACACS+ configuration in the Information pane.
Step 2 Choose the CFS tab. You see the RADIUS or TACACS+ CFS configuration.
Step 3 Choose enable from the Enable > Admin drop-down list for all switches that you want to enable CFS on
for RADIUS or TACACS+.
Step 4 Click Apply Changes to distribute these changes through the fabric.
.

Starting a Distribution Session on a Switch

A distribution session starts the moment you begin a AAA configuration. For example, the following
tasks start an implicit session:
•Specifying the global timeout for RADIUS servers.
•Specifying the global timeout for TACACS+ servers.