Cisco N5010P-N2K-BE, Руководство по настройке программного обеспечения

Страница: 251 / 704

S e n d f e e d b a c k t o n x 5 0 0 0 - d o c f e e d b a c k @ c i s c o . c o m
16-11
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01
Chapter 16 Configuring AAA
Configuring AAA
Using AAA Server VSAs with Nexus 5000 Series Switches
You can use vendor-specific attributes (VSAs) to specify the Nexus 5000 Series user roles and SNMPv3
parameters on AAA servers.
This section includes the following topics:
•
About VSAs, page 16-11
• VSA Format, page 16-11
•
Specifying Cisco Nexus 5000 Series Switch User Roles and SMNPv3 Parameters on AAA Servers,
page 16-12
About VSAs
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating VSAs
between the network access server and the RADIUS server. The IETF uses attribute 26. VSAs allow
vendors to support their own extended attributes that are not suitable for general use. The Cisco RADIUS
implementation supports one vendor-specific option using the format recommended in the specification.
The Cisco vendor ID is 9, and the supported option is vendor type 1, which is named cisco-av-pair. The
value is a string with the following format:
protocol : attribute seperator value *
The protocol is a Cisco attribute for a particular type of authorization, separator is an equal sign (=) for
mandatory attributes, and an asterisk
(
*
) indicates optional attributes.
When you use RADIUS servers for authentication on a Nexus 5000 Series switch, the RADIUS protocol
directs the RADIUS server to return user attributes, such as authorization information, along with
authentication results. This authorization information is specified through VSAs.
VSA Format
The following VSA protocol options are supported by the Nexus 5000 Series switches:
•
Shell— Used in access-accept packets to provide user profile information.
• Accounting—Used in accounting-request packets. If a value contains any white spaces, put it within
double quotation marks.
The following attributes are supported by the Nexus 5000 Series switches:
•
roles—Lists all the roles assigned to the user. The value field is a string that stores the list of group
names delimited by white space.
Step 4
switch# show aaa accounting
(Optional) Displays the configuration AAA
accounting default methods.
Note
The accounting log feature does not log the
show commands, For example, the feature
does not log the
show version or show
module commands.
Step 5
switch# copy running-config startup-config
(Optional) Copies the running configuration to the
startup configuration.
Command Purpose