<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:48" />
    <title>Authorizing and Authenticating the Switch </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1593;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1089667"> </a><h1 class="pTitle">
Authorizing and Authenticating the Switch

</h1>
<a name="wp1088432"> </a><h2 class="pHeading2">
Detailed Steps
</h2>
<a name="wp1268031"> </a><p class="pBody">
To authorize and authenticate the switch, follow these steps:

</p>
<div class="pSmartList1"><ol type="1" class="pSmartList1">
<a name="wp1073178"> </a><li class="pSmartList1">Log in to the required switch in the Cisco MDS 9000 Family, using the Telnet, SSH, DCNM-SAN or 
Device Manager, or console login options.
</li>
<a name="wp1073179"> </a><li class="pSmartList1">When you have configured server groups using the server group authentication method, an 
authentication request is sent to the first AAA server in the group.
</li>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1073180"> </a><li class="pSmartList2">If the AAA server fails to respond, then the next AAA server is contacted and so on until the remote server responds to the authentication request. </li>
<a name="wp1073181"> </a><li class="pSmartList2">If all AAA servers in the server group fail to respond, then the servers in the next server group are contacted.</li>
<a name="wp1073182"> </a><li class="pSmartList2">If all configured methods fail, then by default local database is used for authentication. The next section will describe the way to disable this fallback.</li>
</ul></div>
<a name="wp1073183"> </a><li class="pSmartList1">When you are successfully authenticated through a remote AAA server, then the following possible 
actions are taken:
</li>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1073184"> </a><li class="pSmartList2">If the AAA server protocol is RADIUS, then user roles specified in the<b class="cBold"> cisco-av-pair </b>attribute are downloaded with an authentication response.</li>
<a name="wp1073185"> </a><li class="pSmartList2">If the AAA server protocol is TACACS+, then another request is sent to the same server to get the user roles specified as custom attributes for the shell.</li>
<a name="wp1073186"> </a><li class="pSmartList2">If user roles are not successfully retrieved from the remote AAA server, then the user is assigned the network-operator role if the <span style="font-weight: bold">show aaa user default-role</span> command is enabled. You are denied access if this command is disabled.</li>
</ul></div>
<a name="wp1073187"> </a><li class="pSmartList1">When your user name and password are successfully authenticated locally, you are allowed to log in, and 
you are assigned the roles configured in the local database.
</li>
</ol></div>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
