BigIron RX Series Configuration Guide
97
53-1001810-01
Configuring RADIUS security
4
5. The RADIUS server validates the device using a shared secret (the RADIUS key).
6. The RADIUS server looks up the username in its database.
7. If the username is found in the database, the RADIUS server validates the password.
8. If the password is valid, the RADIUS server sends an Access-Accept packet to the device,
authenticating the user. Within the Access-Accept packet are three
Brocade
vendor-specific
attributes that indicate:
•
The privilege level of the user
•
A list of commands
•
Whether the user is allowed or denied usage of the commands in the list
The last two attributes are used with RADIUS authorization, if configured.
9. The user is authenticated, and the information supplied in the Access-Accept packet for the
user is stored on the device. The user is granted the specified privilege level. If you configure
RADIUS authorization, the user is allowed or denied usage of the commands in the list.
RADIUS authorization
When RADIUS authorization takes place, the following events occur.
1. A user previously authenticated by a RADIUS server enters a command on the device.
2. The device looks at its configuration to see if the command is at a privilege level that requires
RADIUS command authorization.
3. If the command belongs to a privilege level that requires authorization, the device looks at the
list of commands delivered to it in the RADIUS Access-Accept packet when the user was
authenticated. (Along with the command list, an attribute was sent that specifies whether the
user is permitted or denied usage of the commands in the list.)
NOTE
After RADIUS authentication takes place, the command list resides on the BigIron RX. The
RADIUS server is not consulted again once the user has been authenticated. This means that
any changes made to the user’s command list on the RADIUS server are not reflected until the
next time the user is authenticated by the RADIUS server, and the new command list is sent to
the BigIron RX.
4. If the command list indicates that the user is authorized to use the command, the command is
executed.
RADIUS accounting
RADIUS accounting works as follows.
1. One of the following events occur on the device:
•
A user logs into the management interface using Telnet or SSH
•
A user enters a command for which accounting has been configured
•
A system event occurs, such as a reboot or reloading of the configuration file
2. The device checks its configuration to see if the event is one for which RADIUS accounting is
required.
Содержание Brocade DCX
Страница 40: ...xl BigIron RX Series Configuration Guide 53 1001810 01 ...
Страница 72: ...lxxii BigIron RX Series Configuration Guide 53 1001810 01 ...
Страница 88: ...16 BigIron RX Series Configuration Guide 53 1001810 01 Searching and filtering output 1 ...
Страница 300: ...228 BigIron RX Series Configuration Guide 53 1001810 01 Displaying IP information 7 ...
Страница 318: ...246 BigIron RX Series Configuration Guide 53 1001810 01 Deploying a LAG 8 ...
Страница 418: ...346 BigIron RX Series Configuration Guide 53 1001810 01 SuperSpan 12 ...
Страница 482: ...410 BigIron RX Series Configuration Guide 53 1001810 01 MRP CLI example 14 ...
Страница 506: ...434 BigIron RX Series Configuration Guide 53 1001810 01 Displaying VSRP information 15 ...
Страница 566: ...494 BigIron RX Series Configuration Guide 53 1001810 01 QoS for the oversubscribed 16 x 10GE modules 18 ...
Страница 582: ...510 BigIron RX Series Configuration Guide 53 1001810 01 Viewing Layer 2 ACLs 20 ...
Страница 634: ...562 BigIron RX Series Configuration Guide 53 1001810 01 Troubleshooting ACLs 21 ...
Страница 642: ...570 BigIron RX Series Configuration Guide 53 1001810 01 Trunk formation 22 ...
Страница 746: ...674 BigIron RX Series Configuration Guide 53 1001810 01 Displaying RIP filters 24 ...
Страница 808: ...736 BigIron RX Series Configuration Guide 53 1001810 01 Displaying OSPF information 25 ...
Страница 926: ...854 BigIron RX Series Configuration Guide 53 1001810 01 Generalized TTL security mechanism support 26 ...
Страница 938: ...866 BigIron RX Series Configuration Guide 53 1001810 01 Displaying MBGP information 27 ...
Страница 950: ...878 BigIron RX Series Configuration Guide 53 1001810 01 Using secure copy 28 ...
Страница 988: ...916 BigIron RX Series Configuration Guide 53 1001810 01 Clearing IS IS information 29 ...
Страница 998: ...926 BigIron RX Series Configuration Guide 53 1001810 01 Configuring BFD for the specified protocol 30 ...
Страница 1014: ...942 BigIron RX Series Configuration Guide 53 1001810 01 Displaying multi device port authentication information 31 ...
Страница 1054: ...982 BigIron RX Series Configuration Guide 53 1001810 01 Sample 802 1x configurations 33 ...
Страница 1072: ...1000 BigIron RX Series Configuration Guide 53 1001810 01 IP source guard 35 Syntax show ip source guard ethernet port num ...
Страница 1108: ...1036 BigIron RX Series Configuration Guide 53 1001810 01 sFlow 39 ...
Страница 1190: ...1118 BigIron RX Series Configuration Guide 53 1001810 01 Displaying RIPng information 44 ...
Страница 1270: ...1198 BigIron RX Series Configuration Guide 53 1001810 01 Displaying ACLs 47 ...
Страница 1310: ...1238 BigIron RX Series Configuration Guide 53 1001810 01 Displaying OSPFv3 information 48 ...
Страница 1382: ...1310 BigIron RX Series Configuration Guide 53 1001810 01 Commands That Require a Reload D ...
Страница 1435: ...BigIron RX Series Configuration Guide 1363 53 1001810 01 VSRP E ...
Страница 1436: ...1364 BigIron RX Series Configuration Guide 53 1001810 01 VSRP E ...