Cisco Nexus 5000 Series Switch CLI Software Configuration Guide, NX-OS 4.0(1a)N1 (OL-16597-01, January 2009)

Send feedback to nx5000-docfeedback@cisco.com

16-3

Cisco Nexus 5000 Series Switch CLI Software Configuration Guide

OL-16597-01

Chapter 16 Configuring AAA

Information About AAA

• The accounting log for all switches in the fabric can be centrally managed.

• User attributes for each switch in the fabric than using the local databases on the switches are easier

to manage.

AAA Server Groups

You can specify remote AAA servers for authentication, authorization, and accounting using server

groups. A server group is a set of remote AAA servers that implement the same AAA protocol. The

purpose of a server group is to provide for failover servers in case a remote AAA server fails to respond.

If the first remote server in the group fails to respond, the next remote server in the group is tried until

one of the servers sends a response. If all the AAA servers in the server group fail to respond, then that

server group option is considered a failure. If required, you can specify multiple server groups. If a

Nexus 5000 Series switch encounters errors from the servers in the first group, it tries the servers in the

next server group.

AAA Service Configuration Options

On Nexus 5000 Series switches, you can have separate AAA configurations for the following services:

• User Telnet or Secure Shell (SSH) login authentication

• Console login authentication

• User management session accounting

Table 16-1 lists the CLI commands for each AAA service configuration option.

You can specify the following authentication methods for the AAA services:

• RADIUS server groups—Uses the global pool of RADIUS servers for authentication.

• Specified server groups—Uses specified RADIUS or TACACS+ server groups for authentication.

• Local—Uses the local username or password database for authentication.

• None—Uses only the user name.

Note If the method is for all RADIUS servers, instead of a specific server group, the Nexus 5000 Series

switches choose the RADIUS server from the global pool of configured RADIUS servers in the order of

configuration. Servers from this global pool are the servers that can be selectively configured in a

RADIUS server group on the Nexus 5000 Series switches.

Table 16-2 describes the AAA authentication methods that you can configure for the AAA services.