Enterasys Networks 2E253, 2H253, 2H252, 2H258 manual 14Accessing Local Management

Overview of Security Methods

If the server returns an “access-accept” response (the user successfully authenticated), it must also return a Radius “FilterID” attribute containing an ASCII string with the following fields in the specified format:

“Enterasys:version=V:mgmt=M:policy=N”

Where:

V is the version number (currently V=1)

M is the access level for management, one of the following strings:

“su” for super-user access

“rw” for read-write access

“ro” for read-only access

N is the policy profile string (refer to the policy profile MIB)

NOTES:

1. Quotation marks (“ ”) are used for clarification only, and are not part of the command strings.

2.If the FilterID attribute is not returned, or the “mgmt” field is absent or contains an unrecognizable value, access to Local Management is denied.

3.Policy profiles are not yet deployed and the “policy=N” part may be omitted.

The secondary server is always consulted if it is configured. Note that the minimum additional information that must be configured to use a server is its IP and Shared Secret.

A backup secondary server is always consulted if it has been configured with its IP and Shared Secret. If communication is lost to all servers, and the user is connected to the local console serial port, the authorization screen will change to allow access to the switch by using the Local Management Module password.

If the user is connected remotely via TELNET or WebView, the switch will continue to deny access until communication with the Radius Server is operational again. Optionally, if the switch has been configured to allow remote access, the switch can be configured to use the Local Management Module password in the event of a Radius failure.

3-14Accessing Local Management