HP StorageWorks Fabric OS 6.x administrator guide (5697-7344, March 2008)

Fabric OS 6.x administrator guide 75
Configuring authentication servers on the switch
RADIUS and LDAP configuration of the switch is controlled by the aaaConfig command.
At least one RADIUS or LDAP server must be configured before you can enable RADIUS or LDAP service.
You can configure the RADIUS or LDAP service even if it is disabled on the switch. You can configure up to
five RADIUS or LDAP servers. You must be logged in as admin or switchadmin to configure the RADIUS
service.
NOTE: On dual-CP switches (the 4/256 SAN Director and the DC Director), the switch sends its RADIUS
or LDAP request using the IP address of the active CP. When adding clients, add both the active and
standby CP IP addresses so that users can still log in to the switch in the event of a failover.
RADIUS or LDAP configuration is chassis-based configuration data. On platforms containing multiple
switch instances, the configuration applies to all instances. The configuration is persistent across reboot
and firmwareDownload. On a chassis-based system, the command must replicate the configuration to
the standby CP.
Multiple login sessions can invoke the command simultaneously. The last session that applies the change
will be the one whose configuration is in effect. This configuration is persistent after an HA failover.
The RADIUS or LDAP servers are contacted in the order they are listed, starting from the top of the list and
moving to the bottom.
The following procedures show how to use the aaaConfig command to set up a switch for RADIUS or
LDAP service.
To display the current RADIUS configuration:
1. Connect to the switch and log in using an admin account.
2. Enter this command:
switch:admin> aaaConfig --show
If a configuration exists, its parameters are displayed. If RADIUS or LDAP service is not configured, only
the parameter heading line is displayed. Parameters include:
Position The order in which servers are contacted to provide service.
Server The server names or IPv4 or IPv6 addresses.
Port The server ports.
Secret The shared secrets.
Timeouts The length of time servers have to respond before the next server is
contacted.
Authenticati
on
The type of authentication being used on servers.