Users Guide

304 Authentication, Authorization, and Accounting
As a user attempts to connect to the switch management interface, the switch
first detects the contact and prompts the user for a name and password. The
switch encrypts the supplied information, and a RADIUS client transports
the request to a preconfigured RADIUS server.
Figure 9-1. RADIUS Topology
The server can authenticate the user itself or make use of a back-end device to
ascertain authenticity. In either case a response may or may not be
forthcoming to the client. If the server accepts the user, it returns a positive
result with attributes containing configuration information. If the server
rejects the user, it returns a negative result. If the server rejects the client or
the shared secrets differ, the server returns no result. If the server requires
additional verification from the user, it returns a challenge, and the request
process begins again.
If using a RADIUS server to authenticate users, the RADIUS administrator
must configure user attributes in the user database on the RADIUS server.
The user attributes include the user name, password, and privilege level.
NOTE: To set the user privilege level at login, it is required that the Service-Type
attribute be used for RADIUS instead of the vendor proprietary (vendor ID 9, sub-
type 1) AV pair priv-lvl attribute. The Cisco AV priv-lvl is supported only for
TACACS authorization.
Management Host
Primary RADIUS Server
Backup RADIUS Server
Management
Network
Dell EMC Networking
N-Series switch