<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:48" />
    <title>.Configuring Server Groups </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1606;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1078653"> </a><h1 class="pTitle">
<span style="font-weight: normal">.</span>Configuring Server Groups

</h1>
<a name="wp1078654"> </a><p class="pBody">
You can specify one or more remote AAA servers to authenticate users using server groups. All members 
of a group must belong to the same protocol, either RADIUS or TACACS+. The servers are tried in the 
same order in which you configure them.

</p>
<a name="wp1078655"> </a><p class="pBody">
The AAA server monitoring feature can mark an AAA server as dead. You can configure a period of time 
in minutes to elapse before the switch sends requests to a dead AAA server. (See the <a href="cradtac112.html">&quot;AAA Server 
Monitoring&quot; topic</a>).

</p>
<a name="wp1262126"> </a><h2 class="pHeading2">
Restrictions
</h2>
<a name="wp1262127"> </a><p class="pBody">
You can configure these server groups at any time but they only take effect when you apply them to an 
AAA service. You configure AAA policies for CLI users or DCNM-SAN or Device Manager users.

</p>
<a name="wp1268585"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> Configuration of a TACACS+ group fails if MSCHPv2 authentication is not disabled.

</p>
<a name="wp1092968"> </a><h2 class="pHeading2">
Detailed Steps
</h2>
<a name="wp1268590"> </a><p class="pBody">
To configure a RADIUS, TACACS+, or LDAP server group using DCNM-SAN, follow these steps:

</p>
<div class="pSmartList1"><ol type="1" class="pSmartList1">
<a name="wp1268591"> </a><li class="pSmartList1">Expand<b style="font-weight: bold" class="cBold"> Switches</b><span style="font-weight: bold"> &gt; </span><b style="font-weight: bold" class="cBold">Security,</b><span style="font-weight: bold"> </span>and then select <b class="cBold">AAA</b>. 
</li>
<a name="wp1268592"> </a><p class="pListBodyLevel1">
You see the AAA configuration in the Information pane. If you do not see the screen, click the <b class="cBold">Server 
Groups </b>tab.

</p>
<a name="wp1268593"> </a><p class="pListBodyLevel1">
You see the RADIUS, TACACS+, or LDAP server groups configured.

</p>
<a name="wp1268594"> </a><li class="pSmartList1">Click<b class="cBold"> Create Row </b>to create a server group. 
</li>
<a name="wp1268595"> </a><p class="pListBodyLevel1">
You see the Create Server dialog box.

</p>
<a name="wp1268596"> </a><li class="pSmartList1">Click the<b class="cBold"> radius</b> radio button to add a RADIUS server group, the <b style="font-weight: bold" class="cBold">tacacs+ </b><b style="font-weight: normal" class="cBold">radio button </b>to add a 
TACACS+ server group, and the <span style="font-weight: bold">ldap</span> radio button to add a LDAP server group.
</li>
<a name="wp1268597"> </a><li class="pSmartList1">Supply server names for the ServerIdList field.
</li>
<a name="wp1268598"> </a><li class="pSmartList1">When you chose LDAP, enter the LDAP search map name for the LDAPSearchMapName.
</li>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1268599"> </a><li class="pSmartList2">LDAPSSLMODE&#8212;Specifies if the TLS tunnel should be setup before binding with the LDAP server.</li>
<a name="wp1268600"> </a><li class="pSmartList2">LDAPBindFirst&#8212;Specifies if the user bind should be completed before the search.</li>
</ul></div>
<a name="wp1268601"> </a><li class="pSmartList1">Click the <span style="font-weight: bold">plain</span> radio button to select the plain authentication method, click the <span style="font-weight: bold">kerberos </span>button<span style="font-weight: bold"> </span>to select 
the kerberos authentication method, and click <span style="font-weight: bold">md5digest</span> to select the md5digest authentication method.
</li>
<a name="wp1268602"> </a><li class="pSmartList1">Enter the password for the <span style="font-weight: bold">LDAPComparePasswd</span> field:
</li>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1268603"> </a><li class="pSmartList2">LDAPCertDNBind&#8212;Specifies if the User Certification Bind needs to be checked while doing PKI SSH certificate authorization.</li>
<a name="wp1268604"> </a><li class="pSmartList2">LDAPUserServerBind&#8212;Specifies if the User Server Bind should be checked as part of SSH PKI authorization. </li>
</ul></div>
<a name="wp1268605"> </a><li class="pSmartList1">Set the DeadTime field for the number of minutes that a server can be nonresponsive before it is marked 
as bypassed. See the <a href="cradtac133.html">&quot;About Bypassing a Nonresponsive Server&quot; topic</a>.
</li>
<a name="wp1268609"> </a><li class="pSmartList1">Click <b class="cBold">Create</b> to create this server group.
</li>
<a name="wp1268610"> </a><p class="pListBodyLevel1">
The LDAP Server Group displays LDAP-specific parameters.

</p>
<a name="wp1268611"> </a><li class="pSmartList1">Click the <b class="cBold">Applications </b>tab to assign this server group to an application.
</li>
<a name="wp1268612"> </a><p class="pListBodyLevel1">
You can associate a server group with all applications or you can specify specific applications.

</p>
<a name="wp1268613"> </a><li class="pSmartList1">Click the <span style="font-weight: bold">General</span> tab to assign the type of authentication to this server group. 
</li>
<a name="wp1268614"> </a><p class="pListBodyLevel1">
Check either the MSCHAP or MSCHAPv2 check box based on the type of server group.

</p>
<a name="wp1268615"> </a><li class="pSmartList1">Click the <b class="cBold">Apply Changes</b> icon to save the changes.
</li>
<a name="wp1268616"> </a><p class="pListBodyLevel1">
Once the LDAP Server group is created, the configuration information is displayed in two tabs:

</p>
<div class="pSmartList2"><ul class="pSmartList2">
<a name="wp1268617"> </a><li class="pSmartList2">Server Groups&#8212;Displays common data shared by all AAA protocols (RADIUS, TACACS+, and LDAP).</li>
<a name="wp1268618"> </a><li class="pSmartList2">LDAP Server Group&#8212;Displays only LDAP-specific protocols. </li>
</ul></div>
</ol></div>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
