Administrator Guide

242 Authentication, Authorization, and Accounting
As a user attempts to connect to the switch management interface, the switch
first detects the contact and prompts the user for a name and password. The
switch encrypts the supplied information, and a RADIUS client transports
the request to a pre-configured RADIUS server.
Figure 10-1. RADIUS Topology
The server can authenticate the user itself or make use of a back-end device to
ascertain authenticity. In either case a response may or may not be
forthcoming to the client. If the server accepts the user, it returns a positive
result with attributes containing configuration information. If the server
rejects the user, it returns a negative result. If the server rejects the client or
the shared secrets differ, the server returns no result. If the server requires
additional verification from the user, it returns a challenge, and the request
process begins again.
If using a RADIUS server to authenticate users, the RADIUS administrator
must configure user attributes in the user database on the RADIUS server.
The user attributes include the user name, password, and privilege level.
NOTE: To set the user privilege level at login, it is required that the Service-Type
attribute be used for RADIUS instead of the Cisco AV pair priv-lvl attribute. The
Cisco AV priv-lvl is supported only for TACACS authorization.
`
Management Host
Primary RADIUS Server
Backup RADIUS Server
Management
Network
Dell Networking
N-Series switch