Glossary

○ method1 [... method4]: any of the following: RADIUS, TACACS, enable, line, none.
If you do not set the default list, only the local enable is checked. This setting has the same effect as issuing an aaa
authentication enable default enable command.
Enabling AAA Authentication — RADIUS
To enable authentication from the RADIUS server, and use TACACS as a backup, use the following commands.
1. Enable RADIUS and set up TACACS as backup.
CONFIGURATION mode
aaa authentication enable default radius tacacs
2. Establish a host address and password.
CONFIGURATION mode
radius-server host x.x.x.x key some-password
3. Establish a host address and password.
CONFIGURATION mode
tacacs-server host x.x.x.x key some-password
To get enable authentication from the RADIUS server and use TACACS as a backup, issue the following commands.
The following example shows enabling authentication from the RADIUS server.
DellEMC(config)# aaa authentication enable default radius tacacs
Radius and TACACS server has to be properly setup for this.
DellEMC(config)# radius-server host x.x.x.x key <some-password>
DellEMC(config)# tacacs-server host x.x.x.x key <some-password>
To use local enable authentication on the console, while using remote authentication on VTY lines, run the following commands.
The following example shows enabling local authentication for console and remote authentication for the VTY lines.
DellEMC(config)# aaa authentication enable mymethodlist radius tacacs
DellEMC(config)# line vty 0 9
DellEMC(config-line-vty)# enable authentication mymethodlist
Server-Side Configuration
Using AAA authentication, the switch acts as a RADIUS or TACACS+ client to send authentication requests to a TACACS+ or
RADIUS server.
● TACACS+ — When using TACACS+, Dell EMC Networking sends an initial packet with service type SVC_ENABLE, and then
sends a second packet with just the password. The TACACS server must have an entry for username $enable$.
● RADIUS — When using RADIUS authentication, the Dell OS sends an authentication packet with the following:
Username: $enab15$
Password: <password-entered-by-user>
Therefore, the RADIUS server must have an entry for this username.
Configuring Re-Authentication
Starting from Dell EMC Networking OS 9.11(0.0), the system enables re-authentication of user whenever there is a change in
the authenticators.
The change in authentication happens when:
● Add or remove an authentication server (RADIUS/TACACS+)
● Modify an AAA authentication/authorization list
● Change to role-only (RBAC) mode
Security
791