Cisco Nexus 3600 NX-OS, Руководство по настройке безопасности

Страница: 24 / 154

For console login authentication, user login authentication, and user management session accounting, the
Cisco Nexus devices try each option in the order specified. The local option is the default method when
other configured options fail. Note
Authentication and Authorization Process for User Logins
The authentication and authorization process for user login is as occurs:
• When you log in to the required Cisco Nexus device, you can use the Telnet, SSH, Fabric Manager or
Device Manager, or console login options.
• When you have configured the AAA server groups using the server group authentication method, the
Cisco Nexus device sends an authentication request to the first AAA server in the group as follows:
If the AAA server fails to respond, then the next AAA server is tried and so on until the remote server
responds to the authentication request.
If all AAA servers in the server group fail to respond, the servers in the next server group are tried.
If all configured methods fail, the local database is used for authentication.
• If a Cisco Nexus device successfully authenticates you through a remote AAA server, the following
conditions apply:
If the AAA server protocol is RADIUS, user roles specified in the cisco-av-pair attribute are downloaded
with an authentication response.
If the AAA server protocol is , another request is sent to the same server to get the user roles
specified as custom attributes for the shell.
• If your username and password are successfully authenticated locally, the Cisco Nexus device logs you
in and assigns you the roles configured in the local database.
Cisco Nexus 3600 NX-OS Security Configuration Guide, Release 7.x
10
Configuring AAA
Authentication and Authorization Process for User Logins