HP StorageWorks Fabric OS 6.x administrator guide (5697-7344, March 2008)

Fabric OS 6.x administrator guide 77
NOTE: When the RADIUS authentication mode is set to radius;local, you cannot downgrade the Fabric
OS to any version earlier than 5.2.0. Previous versions do not support the radius;local mode.
When the LDAP authentication mode is set to ldap;local, you cannot downgrade the Fabric OS to any
version earlier than 6.x. Previous versions do not support the ldap;local mode.
To enable and disable a RADIUS or LDAP server:
1. Connect to the switch and log in using an admin account.
2. Enter this command to enable RADIUS or LDAP using the local database:
switch:admin> aaaconfig --authspec "<radius | ldap>;local"
where you specify the type of server as either RADIUS or LDAP, but not both. Local is used for local
authentication if the user authentication fails on the RADIUS or LDAP server.
Example
switch:admin> aaaconfig --authspec "radius;local" --backup
To delete a RADIUS or LDAP server from the configuration:
1. Connect to the switch and log in using an admin account.
2. Enter this command:
switch:admin> aaaConfig --remove server | all
When the command succeeds, the event log indicates that the server is removed.
To change a RADIUS server configuration
1. Connect to the switch and log in using an admin account.
2. Enter this command:
switch:admin> aaaConfig --change server [-p port] [-s shared secret] [-t timeout]
[-a pap|chap|peap-mschapv2]
NOTE: Protected Extensible Authentication Protocol (PEAP) is used to authenticate users and clients. It is based on
extensible authentication protocol (EAP) and transport layer security (TLS).
When PEAP is configured on the switch, clients running Fabric Manager cannot authenticate.
server Enter either the name or IP address of the server to be removed.
server Enter either the name or IP address of the server to be changed.
-p port Optional: Enter a server port. The default is 1812.
-s shared secret Optional: Enter a shared secret.
-t timeout Optional: Enter the length of time (in seconds) the server has to
respond before the next server is contacted.
-a
[pap|chap|peap-mscha
pv2]
Specify PAP, CHAP or PEAP as authentication protocol. Use
peap-mschapv2 to provide security on the switch.