Brocade Fabric OS Command Reference - Supporting Fabric OS v7.0.1 (53-1002447-01, March 2012)

Fabric OS Command Reference 5
53-1001764-01
Chapter
2
Fabric OS Commands
aaaConfig
Manages RADIUS and LDAP configuration information.
SYNOPSIS aaaconfig
aaaconfig --show
aaaconfig --add | --change server -conf radius | ldap
[-p port] [-d domain] [-t timeout] [-s secret]
[-a chap | pap | peap-mschapv2]
aaaconfig --remove server -conf radius | ldap
aaaconfig --move server -conf radius | ldap to_position
aaaconfig --authspec aaa1[;aaa2 [-backup] [-nologout]
aaaconfig --help
DESCRIPTION Use this command to manage the RADIUS and LDAP server configuration for the authentication,
authorization and accounting (AAA) services. Use this command to display, add, remove, change,
enable or disable the RADIUS or LDAP configuration.
Brocade switches use a local as well as a remote authentication mechanism for validating a login.
Supported authentication protocols include Password Authentication Protocol (PAP),
Challenge-Handshake Authentication Protocol (CHAP) and Protected Extensible Authentication Protocol
(PEAP). In addition, Fabric OS v6.0.0 and later provides support for Light-weight Directory Access
Protocol (LDAP) authentication against Active Directory for user authentication and authorization.
RADIUS or LDAP servers are contacted in the order they appear in the configuration list. The first server
returning authentication success or failure causes the authentication request to succeed or fail. If no
response is received within the specified timeout, the next RADIUS or LDAP server in the list is
contacted. An event entry logs if all RADIUS or LDAP servers fail to respond.
When the command succeeds, it triggers an event log (the Fabric OS error log) to indicate a server is
added, removed, or modified. Refer to the Fabric OS Message Reference manual for specific details.
There are two modes of operation in LDAP authentication, FIPS mode and non-FIPS mode. However,
there is no option to configure LDAP while the switch is in FIPS mode. The LDAP client checks if FIPS
mode is set on the switch and uses FIPS-compliant TLS ciphers for LDAP. If FIPS mode is not set and
the ADir server is configured for FIPS ciphers, it uses FIPS-compliant ciphers.
Configuration changes are persistently saved and take effect with the next AAA request. The
configuration applies to all switch instances in a platform supporting multiple switch domains.
NOTES Customers can use centralized RADIUS servers to manage AAA services for a switch, as defined in the
RFC 2865 RADIUS specification.
This command can be executed when logged in through the console, Telnet or SSH connection.