<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:48" />
    <title>AAA Service Configuration Options </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1558;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1072897"> </a><h1 class="pTitle">
AAA Service Configuration Options

</h1>
<a name="wp1072898"> </a><p class="pBody">
AAA configuration in Cisco MDS 9000 Family switches is service based. You can have separate AAA 
configurations for the following services:

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1072901"> </a><li class="pSmartList1">Telnet or SSH login (DCNM-SAN and Device Manager login)
</li>
<a name="wp1072902"> </a><li class="pSmartList1">Console login
</li>
<a name="wp1177878"> </a><li class="pSmartList1">iSCSI authentication (see the <span style="font-style: italic">IP Services Configuration Guide</span>, <span style="font-style: italic">Cisco DCNM for SAN</span>).
</li>
<a name="wp1177882"> </a><li class="pSmartList1">FC-SP authentication (see <a href="fcspdh01.html">&quot;Configuring FC-SP and DHCHAP&quot;</a>).
</li>
<a name="wp1177883"> </a><li class="pSmartList1">Accounting
</li>
</ul></div>
<a name="wp1072909"> </a><p class="pBody">
In general, server group, local, and none are the three options that can be specified for any service in an 
AAA configuration. Each option is tried in the order specified. If all the options fail, local is tried. 

</p>
<a name="wp1072910"> </a><p class="pCaution">
<table border="0">
<tr>
<td>
<strong>Caution	&nbsp;&nbsp;&nbsp;</strong>
</td>
<td>
<p>Cisco MDS NX-OS supports user names that are created with alphanumeric characters or specific 
special characters  (+ [plus], = [equal], _ [underscore], - [hyphen] , \ [backslash], and . [period]) whether 
created remotely (using TACACS+ or RADIUS) or locally, provided the user name starts  with an 
alphabetical character. Local user names cannot be created with all numbers or with any special 
characters (apart from those specified).  If a numeric-only user name or a non-supported special 
character user name exists on an AAA server, and is entered during login, then the user is denied access.
</p>
</td>
</tr>
</table>

</p>
<a name="wp1072911"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> Even if local is not specified as one of the options, it is tried by default if all AAA servers configured 
for authentication are unreachable. User has the flexibility to disable this fallback (See section 
<a href="cradtac147.html">&quot;Configuring Fallback Mechanism for Authentication&quot; topic</a>).

</p>
<a name="wp1072915"> </a><p class="pBody">
When RADIUS times out, local login is attempted depending on the fallback configuration. For this local 
login to be successful, a local account for the user with the same password should exist, and the RADIUS 
timeout and retries should take less than 40 seconds. The user is authenticated if the username and 
password exist in the local authentication configuration.

</p>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
