Authentication and Authorization Process
Authentication is the process of verifying the identity of the person managing the switch. This identity verification is
based on the user ID and password combination provided by the person trying to manage the switch. The Cisco MDS 9000 Family
switches allow you to perform local authentication (using the lookup database) or remote authentication (using one or more
RADIUS servers or TACACS+ servers).
The following steps explain the authorization and authentication process. shows a flow chart of the process.
Switch Authorization and Authentication Flow
- When you can log in to the required switch in the Cisco MDS 9000 Family, you have the option to use the Telnet, SSH, or Console
login options.
- Telnet/SSH users, use the aaa authentication login default command.
- Console uses, use the aaa authentication login console command. If this command is not configured the software automatically uses the aaa authentication login default command.
- When you configure server groups using the server group authentication method, an authentication request is sent to the first
AAA server in the group.
- If the AAA server fails to respond, then the next AAA server will be tried and so on until the remote server responds to
the authentication request.
- If all AAA servers in the server group fail to respond, then the servers in the next server group are tried.
- If all configured methods fails, then local database is used for authentication.
- When you are successfully authenticated through a remote AAA server, then the following possibilities apply:
- If AAA server protocol is RADIUS, the user roles specified in cisco-av-pair attribute is downloaded with authentication response
- If AAA server protocol is TACACS+, then another request is sent to the same server to get the user roles specified as custom
attributes for shell
- If user roles were not retrieved successfully from remote AAA server, then the user will have role of network-operator assigned
once he logs in.
- If your user name and password are successfully authenticated, you are allowed to log in.