Saw User Manual

ManualsBrandsCisco Systems ManualsSawSN 5428-2

CHAPTER

9-1

Cisco SN 5428-2 Storage Router Software Configuration Guide

OL-5239-01

Configuring Authentication

This chapter explains how to configure the authentication portion of Cisco’s authentication,

authorization and accounting (AAA) services on the SN 5428-2 Storage Router and how to configure

Enable, Login and iSCSI authentication, which use AAA services.

The following tasks are covered:

• Prerequisite Tasks, page 9-2

• Using Authentication, page 9-2

• Configuration Tasks, page 9-4

• Configuring Authentication Services, page 9-12

• Creating Named Server Groups, page 9-15

• Creating Authentication Lists, page 9-16

• Testing Authentication, page 9-18

• Configuring Two-Way Authentication, page 9-19

• Enabling iSCSI Authentication, page 9-20

• Verifying and Saving Configuration, page 9-20

The AAA function is always enabled for the storage router; it cannot be disabled.

Authentication parameters can be configured using CLI commands, as described in this chapter, or via

the web-based GUI. To access the web-based GUI, point your browser to the storage router’s

management interface IP address. After logging on, click the Help link to access online help for the GUI.

Summary of content (22 pages)

PAGE 1
C H A P T E R 9 Configuring Authentication This chapter explains how to configure the authentication portion of Cisco’s authentication, authorization and accounting (AAA) services on the SN 5428-2 Storage Router and how to configure Enable, Login and iSCSI authentication, which use AAA services.
PAGE 2
Chapter 9 Configuring Authentication Prerequisite Tasks Prerequisite Tasks Before performing AAA configuration tasks on the storage router, make sure you have configured system parameters as described in Chapter 2, “First-Time Configuration,” or Chapter 3, “Configuring System Parameters.” If the storage router is deployed for SCSI routing, you should also configure SCSI routing instances as described in Chapter 6, “Configuring SCSI Routing,” before proceeding.
PAGE 3
Chapter 9 Configuring Authentication Using Authentication Enable Authentication When configured, a user enters password information each time the CLI enable command is entered from the management console, or from a Telnet or SSH management session. If the storage router is configured to allow FTP access, Enable authentication also authenticates users attempting to login and establish an FTP session with the storage router.
PAGE 4
Chapter 9 Configuring Authentication Configuration Tasks Table 9-1 Authentication Services (continued) Authentication Service Description Authentication Types Local or Local-case Uses a local username database on the storage router for authentication. Local-case indicates that the user name authentication is case-sensitive. Passwords authentication is always case-sensitive.
PAGE 5
Chapter 9 Configuring Authentication Configuration Tasks Figure 9-1 iSCSI Authentication Configuration Elements Remote RADIUS servers Remote TACACS+ servers Username database user user user user user user ... ... When iSCSI authentication is enabled, the SCSI routing instance passes the user name and password from the iSCSI driver to AAA for authentication. AAA uses the specified authentication list to determine which services to use for the authentication attempt.
PAGE 6
Chapter 9 Configuring Authentication Configuration Tasks Figure 9-2 iSCSI Authentication Example Configuration Remote TACACS+ servers IP 10.7.0.22 IP 10.7.0 41 IP 10.7.0.45 Global Key: tacacs123SN group janus Username database Remote RADIUS servers IP 10.5.0.61 IP 10.6.0.
PAGE 7
Chapter 9 Configuring Authentication Configuration Tasks Figure 9-3 illustrates AAA configuration elements used for Enable authentication with RADIUS servers, Figure 9-4 illustrates AAA configuration elements used for Enable authentication with TACACS+ servers, and Figure 9-5 illustrates the example configuration of Enable authentication and the authentication services used in this chapter.
PAGE 8
Chapter 9 Configuring Authentication Configuration Tasks Figure 9-4 Enable Authentication Configuration Elements with TACACS+ Servers Remote TACACS+ servers When Enable authentication is enabled, authentication is required when the user attempts Administrator mode access via the CLI "enable" command. Administrator password The user is prompted for a password, which is sent along with the user name entered at login, to AAA for authentication.
PAGE 9
Chapter 9 Configuring Authentication Configuration Tasks Figure 9-5 Enable Authentication Example Configuration group sysadmin Remote TACACS+ servers IP 10.7.0.22 IP 10.7.0.
PAGE 10
Chapter 9 Configuring Authentication Configuration Tasks Figure 9-6 illustrates AAA configuration elements used for Login authentication and Figure 9-7 illustrates the example configuration of Login authentication and the authentication services used in this chapter.
PAGE 11
Chapter 9 Configuring Authentication Configuration Tasks Figure 9-7 Login Authentication Example Configuration group sysadmin Remote TACACS+ servers IP 10.7.0.22 IP 10.7.0.
PAGE 12
Chapter 9 Configuring Authentication Configuring Authentication Services Configuring Authentication Services Configuring authentication services consists of setting the appropriate parameters for the various AAA service options that can be used by the storage router. The storage router can use any or all of the supported services: • RADIUS • TACACS+ • Local username database • Enable • Monitor Use the procedures that follow to configure the storage router to use each of these services.
PAGE 13
Chapter 9 Configuring Authentication Configuring Authentication Services TACACS+ Hosts Use the commands in the following procedure to configure TACACS+ authentication services. Command Description Step 1 enable Enter Administrator mode. Step 2 tacacs-server host 10.7.0.22 Specify the TACACS+ servers to be used for authentication. For example, specify the TACACS+ servers at 10.7.0.22, 10.7.0.41, and 10.7.0.45 for use by the storage router.
PAGE 14
Chapter 9 Configuring Authentication Configuring Authentication Services The following rules apply to passwords: • Passwords are entered in clear text. However, they are changed to “XXXXX” in the CLI command history cache, and are stored in the local username database in an encrypted format. • If the password contains embedded spaces, enclose it with single or double quotes. • After initial entry, passwords display in their encrypted format.
PAGE 15
Chapter 9 Configuring Authentication Creating Named Server Groups Creating Named Server Groups By default, you can use all configured RADIUS or TACACS+ servers for authentication. All configured RADIUS servers belong to the default group named radius. All configured TACACS+ servers belong to the default group named tacacs+. You can also create named groups of RADIUS or TACACS+ servers, to be used for specific authentication purposes.
PAGE 16
Chapter 9 Configuring Authentication Creating Authentication Lists Step 3 Command Description aaa group server tacacs+ sysadmin server 10.7.0.22 Add a TACACS+ server to the named group. For example, add the TACACS+ server at IP address 10.7.0.22 to the group named sysadmin. Because no port is specified, authentication requests to this server use the default port 49. Servers are accessed in the order in which they are defined within the named group.
PAGE 17
Chapter 9 Configuring Authentication Creating Authentication Lists Enable authentication Use the commands in the following procedure to build a default list of authentication services to be used for Enable authentication. Building the default list completes the configuration of Enable authentication and makes it immediately effective. Command Description Step 1 enable Enter Administrator mode.
PAGE 18
Chapter 9 Configuring Authentication Testing Authentication Testing Authentication You can perform authentication testing at any time. For example, before enabling iSCSI authentication for a SCSI routing instance, you can test iSCSI authentication. The user name and password are passed to AAA, which performs authentication using the specified iSCSI authentication list. The command response indicates a pass or fail status.
PAGE 19
Chapter 9 Configuring Authentication Configuring Two-Way Authentication Login Authentication Use the commands in the following procedure to test Login authentication. Command Description Step 1 enable Enter Administrator mode. Step 2 aaa test authentication login default sysmonitor ciscomonitor Test the user name and password configured for Monitor mode access to the storage router. AAA uses the services in the default authentication list (Example 9-3).
PAGE 20
Chapter 9 Configuring Authentication Enabling iSCSI Authentication Enabling iSCSI Authentication iSCSI authentication is enabled for specific SCSI routing instances. By default, iSCSI authentication is not enabled. Use the commands in the following procedure to enable iSCSI authentication using the authentication services configured in the specified authentication list. Command Description Step 1 enable Enter Administrator mode.
PAGE 21
Chapter 9 Configuring Authentication Verifying and Saving Configuration Example 9-4 Display AAA Configuration [SN5428-2-MG1]# show aaa aaa new-model username "labserver" password "9 491c083a73d7f89bc0205927d086cdd0d8" username "labserver2" password "9 5ccd52d543e0d3a5558afe8cbe2867dd41" radius-server key "9 64ced29a261a8ca554a6f4ea8d494669c1" radius-server host 10.6.0.53 auth-port 1645 radius-server host 10.6.0.73 auth-port 1645 radius-server host 10.5.0.
PAGE 22
Chapter 9 Configuring Authentication Verifying and Saving Configuration Cisco SN 5428-2 Storage Router Software Configuration Guide 9-22 OL-5239-01