Reference Guide

Brocade Fabric OS Command Reference 5
53-1004112-02
Fabric OS Commands
aaaConfig
Manages RADIUS, LDAP, and TACACS+ configuration information.
Synopsis aaaconfig
aaaconfig --show
aaaconfig --add | --change server -conf radius | ldap | tacacs+
[-p port] [-d domain] [-t timeout] [-s secret]
[-a chap | pap | peap-mschapv2] [-e encr_type]
aaaconfig --remove server -conf radius | ldap | tacacs+
aaaconfig --move server -conf radius | ldap | tacacs+ to_position
aaaconfig --authspec aaa1[;aaa2 [-backup] [-nologout]
aaaconfig --help
Description Use this command to manage the RADIUS, LDAP, and TACACS+ server configuration for the authentication,
authorization and accounting (AAA) services. Use this command to display, add, remove, change, enable or disable
the RADIUS, LDAP, or TACACS+ configuration.
Brocade switches use a local as well as a remote authentication mechanism for validating a login. Supported
authentication protocols include Password Authentication Protocol (PAP), Challenge-Handshake Authentication
Protocol (CHAP) and Protected Extensible Authentication Protocol (PEAP). Light-weight Directory Access
Protocol (LDAP) authentication against Active Directory for user authentication and authorization is supported.
RADIUS, LDAP or TACACS+ servers are contacted in the order they appear in the configuration list. The first
server returning authentication success or failure causes the authentication request to succeed or fail. If no
response is received within the specified timeout, the next RADIUS, LDAP, or TACACS+ server in the list is
contacted. An event entry logs if all RADIUS, LDAP, or TACACS+ servers fail to respond.
When the command succeeds, it triggers an event log (the Fabric OS error log) to indicate a server is added,
removed, or modified. Refer to the Fabric OS Message Reference manual for specific details.
There are two modes of operation in LDAP authentication, FIPS mode and non-FIPS mode. However, there is no
option to configure LDAP while the switch is in FIPS mode. The LDAP client checks if FIPS mode is set on the
switch and uses FIPS-compliant TLS ciphers for LDAP. If FIPS mode is not set and the ADir server is configured
for FIPS ciphers, it uses FIPS-compliant ciphers.
Configuration changes are persistently saved and take effect with the next AAA request. The configuration applies
to all switch instances in a platform supporting multiple switch domains.