Dell EMC SmartFabric OS10 User Guide Release 10.5.2

PDF

AAA authentication

An OS10 switch uses a list of authentication methods to define the types of authentication and the sequence in which they apply. By default, OS10 uses only the local authentication method.

The authentication methods in the method list execute in the order you configure them. Re-enter the methods to change the order. The local authentication method remains enabled even if you remove all configured methods in the list using the no aaa authentication login {console | default} command.

NOTE:If you configure multiple authentication methods on Dell EMC PowerEdge MX7000 Ethernet switches—MX9116n Fabric Switching Engine and MX5108n Ethernet Switch—operating in SmartFabric mode, you must configure local authentication as the first method in the list.

Configure the AAA authentication method in CONFIGURATION mode.
```
aaa authentication login {console | default} {local | group radius | group tacacs+}
```
- console—Configure authentication methods for console logins.
- default—Configure authentication methods for nonconsole such as SSH and Telnet logins.
- local—Use the local username, password, and role entries configured with the username password role command.
- group radius—Configure RADIUS servers using the radius-server host command.
- group tacacs+—Configure TACACS+ servers using the tacacs-server host command.

Configure user role on server

If a console user logs in with RADIUS or TACACS+ authentication, the role you configured for the user on the RADIUS or TACACS+ server applies. User authentication fails if no role is configured on the authentication server.

To authenticate a user on OS10 through a TACACS+ server, configure the mandatory role with a value. This example uses Cisco ISE as the AAA server and the TACACS server configuration is shown in the following figure. This example uses the sysadmin role along with the corresponding privilege level 15 on the TACACS+ Server.

TACACS server configuration

NOTE:OS10 supports only the VSA to assign user roles. Other VSAs are not supported.

Also, you must configure the user role on the RADIUS or TACACS+ server using the vendor-specific attribute (VSA) or the authentication fails. The vendor ID of Dell EMC is 674. Create a VSA with Name = Dell-group-name, OID = 2, Type = string. Valid values for Dell-group-name are:

Table 1. OS10 user roles and privilege levelsOS10 user roles and privilege levels
User role	Default privilege level
sysadmin	15
secadmin	15
netadmin	15
netoperator	1

Use the VSA Dell-group-name values when you create users on a Radius or TACACS+ server.

For more information about privilege levels, see Privilege levels.

For detailed information about how to configure vendor-specific attributes on a RADIUS or TACACS+ server, see the respective RADIUS or TACACS+ server documentation.

Configure AAA authentication

OS10(config)# aaa authentication login default group radius local 
OS10(config)# do show running-configuration aaa
aaa authentication login default group radius local
aaa authentication login console local

Remove AAA authentication methods

OS10(config)# no aaa authentication login default 
OS10(config)# do show running-configuration aaa
aaa authentication login default local
aaa authentication login console local