Lenovo Flex System Fabric CN4093, Инструкция по применению

Страница: 583 / 634

© Copyright Lenovo 2017 Chapter 39: Secure Input/Output Module
583
Switch Access in SIOM Mode
After the embedded switch is provisioned by the CMM in the SIOM mode, the
switch will automatically update its LDAP settings (
startTLS
,
LDAPS
or
LDAP
)
to the ones configured on the CMM. When no external LDAP server is configured
on the CMM, CMM itself will serve as the local LDAP server. The LDAP client
configured on the CMM is pushed onto the switch and the LDAP credentials used
to access the CMM can also be used to access the switch.
To access the switch, you may now use one of the following methods:

The CMM credentials

Other user credentials which depend on the SIOM security policy setting, as
follows:

In legacy mode, if RADIUS or is enabled, they will replace LDAP
as the authentication method. If LDAP backdoor mode is enabled, you can
still use local authentication by using
noldap
as the username.

In secure mode, you may use the provisioned LDAP credentials.
Notes:
 Once the switch is provisioned by the CMM in SIOM mode, it cannot be
accessed using the switch local user accounts.
 The switch may perform an additional reboot automatically after changing the
SIOM state or upgrading the CMM software.
Using SIOM with Stacking
In stacking mode, configuring SIOM is only supported on the Master switch.
Hence, the command:
is only supported on the Master switch. On stack member switches, SIOM is
configured by the Master switch, and the member switches automatically inherit
the Master switch SIOM setting. When upgrading to SIOM ‐ capable software:
 The Master, Backup, and member switches need to be rebooted for SIOM to take
effect.
 When SIOM is enabled on the Master, it is applied on all stack members
automatically.
 If a new switch with a different boot SIOM configuration is attached to the stack,
the switch will inherit the boot SIOM configuration from the Master and will
automatically reboot.
 When two stacks are joined, the selected Master for the two stacks will push its
own boot SIOM configuration, and the added members will automatically
reboot.
 There will be no changes in the SIOM policy on members if the stack is split.
Note:
Lenovo recommends using staggered upgrade. In this case, the upgrade will
take more time, depending on how large the stack setup is, but the traffic loss will
be minimal.
CN 4093# [no] boot siom enable