Administrator Guide

Fabric OS Administrator’s Guide 99
53-1001763-02
The authentication model using RADIUS and LDAP
5
8. Enter the boot PROM password at the prompt, then re-enter it when prompted. The password
must be eight alphanumeric characters (any additional characters are not recorded). Record
this password for future use.
9. Enter the saveEnv command to save the new password.
10. Reboot the standby CP blade by entering the reset command.
11. Connect to the active CP blade by serial or Telnet and enter the haEnable command to restore
high availability; then fail over the active CP blade by entering the haFailover command.
Traffic resumes flowing through the newly active CP blade after it has completed rebooting.
12. Connect the serial cable to the serial port on the new standby CP blade (previously the active
CP blade).
13. Repeat step 3 through step 10 for the new standby CP blade.
14. Connect to the active CP blade by serial or Telnet and enter the haEnable command to restore
high availability.
NOTE
To recover lost passwords refer to the Fabric OS Troubleshooting and Diagnostics Guide.
The authentication model using RADIUS and LDAP
Fabric OS supports the use of either the local user database and the remote authentication dial-in
user service (RADIUS) at the same time; or the local user database and lightweight directory
access protocol (LDAP) using Microsoft Active Directory in Windows at the same time. A switch can
be configured to try both RADIUS or LDAP and local switch authentication.
When configured to use either RADIUS or LDAP, the switch acts as a network access server (NAS)
and RADIUS or LDAP client. The switch sends all authentication, authorization, and accounting
(AAA) service requests to the RADIUS or LDAP server. The RADIUS or LDAP server receives the
request, validates the request, and sends its response back to the switch.
The supported management access channels that integrate with RADIUS or LDAP include serial
port, Telnet, SSH, Web Tools, and API. All these require the switch IP address or name to connect.
The RADIUS server accepts both IPv4 and IPv6 address formats, while the LDAP server accepts
only an IPv4 address. For accessing both the active and standby CP, and for the purpose of HA
failover, both CP IP addresses of a director should be included in the RADIUS or LDAP server
configuration.
NOTE
For systems such as the Brocade 48000 and Brocade DCX enterprise-class platforms, the switch IP
addresses are aliases of the physical Ethernet interfaces on the CP blades. When specifying client
IP addresses for the logical switches in such systems, make sure the CP IP addresses are used.
When configured for RADIUS or LDAP, a switch becomes a RADIUS or LDAP client. In either of these
configurations, authentication records are stored in the RADIUS or LDAP host server database.
Login and logout account name, assigned role, and time-accounting records are also stored on the
RADIUS or LDAP server for each user.
By default, the RADIUS and LDAP services are disabled, so AAA services default to the switch’s
local database.