Overview of Security Methods
3-14 Accessing Local Management
If the server returns an “access-accept” response (the user successfully authenticated), it must also
return a Radius “FilterID” attribute containing an ASCII string with the following fields in the
specified format:
“Enterasys:version=V:mgmt=M:policy=N”
Where:
V is the version number (currently V=1)
M is the access level for management, one of the following strings:
“su” for super-user access
“rw” for read-write access
“ro” for read-only access
N is the policy profile string (refer to the policy profile MIB)
The secondary server is always consulted if it is configured. Note that the minimum additional
information that must be configured to use a server is its IP and Shared Secret.
A backup secondary server is always consulted if it has been configured with its IP and Shared
Secret. If communication is lost to all servers, and the user is connected to the local console serial
port, the authorization screen will change to allow access to the switch by using the Local
Management Module password.
If the user is connected remotely via TELNET or WebView, the switch will continue to deny
access until communication with the Radius Server is operational again. Optionally, if the switch
has been configured to allow remote access, the switch can be configured to use the Local
Management Module password in the event of a Radius failure.
NOTES:
1. Quotation marks (“ ”) are used for clarification only, and are not part of the command
strings.
2. If the FilterID attribute is not returned, or the “mgmt” field is absent or contains an
unrecognizable value, access to Local Management is denied.
3. Policy profiles are not yet deployed and the “policy=N” part may be omitted.