HP StorageWorks Fabric OS 6.2 administrator guide (5697-0016, May 2009)

Fabric OS 6.2 administrator guide 97
where you specify the type of server as either RADIUS or LDAP, but not both; local is used for local
authentication if the user authentication fails on the RADIUS or LDAP server.
Example
switch:admin> aaaconfig --authspec "radius;local" --backup
Deleting a RADIUS or LDAP server from the configuration
1. Connect to the switch and log in using an account assigned to the admin role.
2. Enter the following command:
switch:admin> aaaConfig --remove server | all
For server, enter either the name of the IP address of the server to be removed. When the command
succeeds, the event log indicates that the server is removed.
Changing a RADIUS server configuration
1. Connect to the switch and log in using an account assigned to the admin role.
2. Enter the following command:
switch:admin> aaaConfig --change server [-p port] [-s shared secret] [-t
timeout] [-a pap|chap|peap-mschapv2]
NOTE: Protected extensible authentication protocol (PEAP) is used to authenticate users and clients. It is
based on extensible authentication protocol (EAP) and transport layer security (TLS).
When PEAP is configured on the switch, clients running Fabric Manager cannot authenticate.
Changing an LDAP server configuration
1. Connect to the switch and log in using an account assigned to the admin role.
2. Enter the following command:
switch:admin> aaaConfig --change server [-p port] [-t timeout] [-d
domain_name]
Changing the order in which RADIUS or LDAP servers are contacted for service
1. Connect to the switch and log in using an account assigned to the admin role.
2. Enter the following command:
switch:admin> aaaConfig --move server to_position
server Enter either the name or IP address of the server to be changed.
-p port Optional: Enter a server port. The default is 1812.
-s shared secret Optional: Enter a shared secret.
-t timeout Optional: Enter the length of time (in seconds) the server has to
respond before the next server is contacted.
-a
[pap|chap|peap-mscha
pv2]
Specify PAP, CHAP or PEAP as authentication protocol. Use
peap-mschapv2 to provide security on the switch.
server Enter either a server name or IPv4 address. Microsoft Active Directory does not
support IPv6 addresses. Avoid duplicating server listings (that is, listing the same
server once by name and again by IP address). Up to five servers can be added
to the configuration.
-p port Optional: Enter a server port. The default is port 389.
-t timeout Optional: Enter the length of time (in seconds) that the server has to respond
before the next server is contacted. The default is three seconds. Time-out values
can range from 1 to 30 seconds.
-d domain_name Enter the name of the Windows domain.