> # Authorizing and Authenticating the Switch

> ## Detailed Steps

> To authorize and authenticate the switch, follow these steps:

> 1. Log in to the required switch in the Cisco MDS 9000 Family, using the Telnet, SSH, DCNM-SAN or Device Manager, or console login options.
> 2. When you have configured server groups using the server group authentication method, an authentication request is sent to the first AAA server in the group.
> - If the AAA server fails to respond, then the next AAA server is contacted and so on until the remote server responds to the authentication request.
> - If all AAA servers in the server group fail to respond, then the servers in the next server group are contacted.
> - If all configured methods fail, then by default local database is used for authentication. The next section will describe the way to disable this fallback.
> 3. When you are successfully authenticated through a remote AAA server, then the following possible actions are taken:
> - If the AAA server protocol is RADIUS, then user roles specified in the cisco-av-pair attribute are downloaded with an authentication response.
> - If the AAA server protocol is TACACS+, then another request is sent to the same server to get the user roles specified as custom attributes for the shell.
> - If user roles are not successfully retrieved from the remote AAA server, then the user is assigned the network-operator role if the show aaa user default-role command is enabled. You are denied access if this command is disabled.
> 4. When your user name and password are successfully authenticated locally, you are allowed to log in, and you are assigned the roles configured in the local database.

> Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.