Lenovo Flex System Fabric CN4093, Application Manual

Page: 591 / 634

© Copyright Lenovo 2017 Chapter 39: Secure Input/Output Module
591
Implementing Secure LDAP (LDAPS)
Lightweight Directory Access Protocol (LDAP) is a protocol for accessing
distributed directory information services over a network. Enterprise NOS uses
LDAP for authentication and authorization. With an LDAP client enabled, the
switch will authenticate a user and determine the user’s privilege level by checking
with one or more directory servers instead of a local database of users. This
prevents customers from having to configure local user accounts on multiple
switches; they can maintain a centralized directory instead.
As part of SIOM, you can implement Secure Lightweight Directory Access Protocol
(LDAPS) in addition to standard LDAP.
Enabling LDAPS
When the IOM is in SIOM mode, all LDAP configurations are made from the CMM
and pushed to the IOM. When the IOM is in LIOM mode, the CLI can be used to
configure LDAP settings. LDAPS is disabled by default. To enable LDAPS:
1.
Turn LDAP authentication on
2.
Enable LDAP Enhanced Mode:
This changes the
ldap-server
subcommands to support LDAPS.
3.
Configure the IPv4 addresses of each LDAP server.
4.
You may change the default TCP port number used to listen to LDAPS (optional).
The well ‐ known port for LDAP is 636.
5.
Configure the Security Mode:
where:
CN 4093(config)# ldap-server enable
CN 4093(config)# ldap-server mode enhanced
CN 4093(config)# ldap-server host {1-4}
<IP address or hostname>
CN 4093(config)# ldap-server port
<1 ‐ 65000>
CN 4093(config)# ldap-server security {clear|ldaps|mutual|starttls}
Parameter Description
clear
Cleartext Mode (no security)
ldaps
LDAPS Mode
mutual
Mutual authentication in Transport Layer Security (TLS)
starttls
Secure LDAP via StartTLS without cleartext fallback