R21xx-HP FlexFabric 11900 Fundamentals Configuration Guide

[Switch] user-interface vty 0 15

[Switch-ui-vty0-15] authentication-mode scheme

[Switch-ui-vty0-15] quit

# Enable remote-then-local authentication for user role switching.

[Switch] super authentication-mode scheme local

# Create the HWTACACS scheme hwtac and enter its view.

[Switch] hwtacacs scheme hwtac

# Specify the primary authentication server address 10.1.1.1 and the service port 49 in the

scheme.

[Switch-hwtacacs-hwtac] primary authentication 10.1.1.1 49

# Set the shared key to expert in the scheme for the switch to authenticate to the server.

[Switch-hwtacacs-hwtac] key authentication simple expert

# Exclude the ISP domain name from the username sent to the HWTACACS server.

[Switch-hwtacacs-hwtac] user-name-format without-domain

[Switch-hwtacacs-hwtac] quit

# Create ISP domain bbb and enter its view.

[Switch] domain bbb

# Configure ISP domain bbb to use local authentication for login users.

[Switch-isp-bbb] authentication login local

# Configure ISP domain bbb to use local authorization for login users.

[Switch-isp-bbb] authorization login local

# Apply the HWTACACS scheme hwtac to the ISP domain.

[Switch-isp-bbb] authentication super hwtacacs-scheme hwtac

[Switch-isp-bbb] quit

# Create a management local user named test and enter its view. Set the service type to Telnet,

and set the password to aabbcc.

[Switch] local-user test class manage

[Switch-luser-manage-test] service-type telnet

[Switch-luser-manage-test] password simple aabbcc

# Assign level-0 to the user.

[Switch-luser-manage-test] authorization-attribute user-role level-0

# Delete the defualt user role network admin.

[Switch-luser-manage-test] undo authorization-attribute user-role network-operator

[Switch-luser-manage-test] quit

# Set the switching password to 654321 for the user role level-3.

[Switch] super password role level-3 simple 654321

[Switch] quit

2. Configure the HWTACACS server:

This example uses ACSv4.0.

a. Add a user account test.

b. Access the Advanced TACACS+ Settings page.

c. Select Level 3 for the Max Privilege for any AAA Client option.

d. Select the Use separate password option, and specify enabpass as the password.