Technical data

Fabric OS Administrator’s Guide 3-13

Publication Number: 53-0000518-09

Setting Up RADIUS AAA Service

• Enabling the Challenge Handshake Authentication Protocol (CHAP)

If CHAP authentication is required, then Windows must be configured to store passwords with

reversible encryption. Reverse password encryption is not the default behavior; it must be enabled.

• Configuring a user

Internet Authentication Service (IAS) is the Microsoft implementation of a RADIUS server and

proxy

. IAS uses the Windows native user database to verify user login credentials; it does not list

specific users, but instead lists user groups. Each user group should be associated with a specific

switch login role. For example, you should configure a user group for root, admin, factory,

switchAdmin, and user, and then add any users whose logins you want to associate to the

appropriate group.

• Configuring the server

To enable CHAP

1. From the Windows Start menu, select Programs> Administrative Tools> Local Security Policy

to open the Local Security Settings window.

2. In the Local Security Settings window, expand the Account Policies folder and select the

Password Policy folder. From the list of policies in the Password Policy folder, right-click Store

password using reversible encryption for all users in the domain, and select Security from the

pop-up menu.

3. An additional Local Security Settings window appears. Click the Enabled radio button and then

click OK.

To configure users

1. From the Windows Start menu, select Programs> Administrative Tools>Computer

Management to open the Computer Management window.

2. In the Computer Management window, expand the Local Users and Groups folder and select the

Groups folder. Right-click the Groups folder and select New Group from the pop-up menu.

3. In the New Group window, provide a Name and Description for the group and click Add.

4. In the Select Users or Groups window, select the user–who should already have been configured–

you want to add to the group and click Add. Repeat this for every user you want to add. When you

have completed adding all users, click OK.

5. In the New Group window, verify that the users you added in step 4 appear in the Members field;

then click Create to create this group.

The new groups are created for each login type (admin, switchAdmin, user).

ote

If a user is configured prior to enabling reverse password encryption, then the user’s password is stored

and cannot utilize CHAP. To use CHAP, the password must be reentered after encryption is enabled. If

the password is not reentered, then CHAP authentication will not work and the user will be unable to

authenticate from the switch.