Feedback
Table Of Contents
Configuring RADIUS and TACACS+
Fabric Manager Security Options
Remote Authentication Guidelines
Authentication and Authorization Process
Configuring RADIUS Server Monitoring Parameters
About RADIUS Server Default Configuration
About the Default RADIUS Server Encryption Type and Preshared Key
Configuring the Default RADIUS Server Encryption Type and Preshared Key
Setting the Default RADIUS Server Timeout Interval and Retransmits
Configuring the Test Idle Timer
About Validating a RADIUS Server
Periodically Validating a RADIUS Server
Displaying RADIUS Server Statistics
About Users Specifying a RADIUS Server at Login
Allowing Users to Specify a RADIUS Server at Login
About Vendor-Specific Attributes
Specifying SNMPv3 on AAA Servers
Configuring TACACS+ Server Monitoring Parameters
About TACACS+ Server Default Configuration
About the Default TACACS+ Server Encryption Type and Preshared Key
Setting the Default TACACS+ Server Encryption Type and Preshared Key
Setting the Default TACACS+ Server Timeout Interval and Retransmits
About Validating a TACACS+ Server
Periodically Validating a TACACS+ Server
Displaying TACACS+ Server Statistics
About Users Specifying a TACACS+ Server at Login
Allowing Users to Specify a TACACS+ Server at Login
About Custom Attributes for Roles
About Configuring Server Groups
About Bypassing a Nonresponsive Server
Enabling AAA Server Distribution
Starting a Distribution Session on a Switch
Displaying the Configuration to be Distributed
Discarding the Distribution Session
Merge Guidelines for RADIUS and TACACS+ Configurations
Enabling MSCHAP Authentication
Configuring Cisco Access Control Servers
Configuring RADIUS and TACACS+
The authentication, authorization, and accounting (AAA) feature verifies the identity of, grants access to, and tracks the actions of users managing a switch. All Cisco MDS 9000 Family switches use RADIUS and TACACS+ protocols to provide solutions using remote AAA servers.
Based on the user ID and password combination provided, switches perform local authentication or authorization using the local database or remote authentication or authorization using a AAA server. A preshared secret key provides security for communication between the switch and AAA servers. This secret key can be configured for all AAA servers or for only a specific AAA server. This security feature provides a central management capability for AAA servers.
This chapter includes the following sections:
•
Configuring RADIUS Server Monitoring Parameters
•
•
Switch Management Security
Management security in any switch in the Cisco MDS 9000 Family provides security to all management access methods, including the command-line interface (CLI) or Simple Network Management Protocol (SNMP).
This section includes the following topics:
•
Fabric Manager Security Options
You can access Fabric Manager using the console (serial connection), Telnet, or Secure Shell (SSH). For each management path (console, Telnet, and SSH), you can configure one or more of the following security control options: local, remote (RADIUS or TACACS+), or none.
•
–
–
•
These security features can also be configured for the following scenarios:
•
•
SNMP Security Options
The SNMP agent supports security features for SNMPv1, SNMPv2c, and SNMPv3. Normal SNMP security features apply to all applications that use SNMP (for example, Cisco MDS 9000 Fabric Manager).
SNMP security options also apply to the Fabric Manager and Device Manager.
See Chapter 38, "Configuring SNMP".
Switch AAA
Using the CLI or Fabric Manager, you can configure AAA switch functionalities on any switch in the Cisco MDS 9000 Family.
This section includes the following topics:
•
•
Authentication
Authentication is the process of verifying the identity of the person or device accessing the switch. This identity verification is based on the user ID and password combination provided by the entity trying to access the switch. Cisco MDS 9000 Family switches allow you to perform local authentication (using the local lookup database) or remote authentication (using one or more RADIUS or TACACS+ servers).
Note
Note
Authorization
The following authorization roles exist in all Cisco MDS switches:
•
•
•
These roles cannot be changed or deleted. You can create additional roles and configure the following options:
•
•
Note
Accounting
The accounting feature tracks and maintains a log of every management configuration used to access the switch. This information can be used to generate reports for troubleshooting and auditing purposes. Accounting logs can be stored locally or sent to remote AAA servers.
Remote AAA Services
Remote AAA services provided through RADIUS and TACACS+ protocols have the following advantages over local AAA services:
•
•
•
•
Remote Authentication Guidelines
If you prefer using remote AAA servers, follow these guidelines:
•
•
•
•
Server Groups
You can specify remote AAA servers for authentication, authorization, and accounting using server groups. A server group is a set of remote AAA servers implementing the same AAA protocol. The purpose of a server group is to provide for failover servers in case a remote AAA server fails to respond. If the first remote server in the group fails to respond, the next remote server in the group is tried until one of the servers sends a response. If all the AAA servers in the server group fail to respond, then that server group option is considered a failure. If required, you can specify multiple server groups. If the Cisco MDS switch encounters errors from the servers in the first group, it tries the servers in the next server group.
AAA Configuration Options
AAA configuration in Cisco MDS 9000 Family switches is service based. You can have separate AAA configurations for the following services:
•
•
•
•
•
In general, server group, local, and none are the three options that can be specified for any service in an AAA configuration. Each option is tried in the order specified. If all the options fail, local is tried.
Caution
Note
When RADIUS times out, local login is always attempted. For this local login to be successful, a local account for the user with the same password should exist, and the RADIUS timeout and retries should take less than 40 seconds. The user is authenticated if the username and password exist in the local authentication configuration.
AAA Server Monitoring
An unresponsive AAA server introduces a delay in the processing of AAA requests. An MDS switch can periodically monitor an AAA server to check whether it is responding (or alive) to save time in processing AAA requests. The MDS switch marks unresponsive AAA servers as dead and does not send AAA requests to any dead AAA servers. An MDS switch periodically monitors dead AAA servers and brings them to the alive state once they are responding. This monitoring process verifies that an AAA server is in a working state before real AAA requests are sent its way. Whenever an AAA server changes to the dead or alive state, an SNMP trap is generated and the MDS switch warns the administrator that a failure is taking place before it can impact performance. See Figure 39-1 for AAA server states.
Figure 39-1 AAA Server States
Note
The user name and password to be used in the test packet can be configured.
See the "Configuring RADIUS Server Monitoring Parameters" section.
Authentication and Authorization Process
Authentication is the process of verifying the identity of the person managing the switch. This identity verification is based on the user ID and password combination provided by the person managing the switch. The Cisco MDS 9000 Family switches allow you to perform local authentication (using the lookup database) or remote authentication (using one or more RADIUS servers or TACACS+ servers).
The following steps explain the authorization and authentication process:
Step 1
Step 2
•
•
•
Step 3
•
•
•
Step 4
Figure 39-2 shows a flow chart of the authorization and authentication process.
Figure 39-2 Switch Authorization and Authentication Flow
Note
No more servers left = no response from any server within this server group.
Configuring RADIUS Server Monitoring Parameters
Cisco MDS 9000 Family switches can use the RADIUS protocol to communicate with remote AAA servers. You can configure multiple RADIUS servers and server groups and set timeout and retry counts.
RADIUS is a distributed client/server protocol that secures networks against unauthorized access. In the Cisco implementation, RADIUS clients run on Cisco MDS 9000 Family switches and send authentication requests to a central RADIUS server that contains all user authentication and network service access information.
This section defines the RADIUS operation, identifies its network environments, and describes its configuration possibilities.
This section includes the following topics:
•
•
•
•
•
•
•
•
•
About RADIUS Server Default Configuration
Fabric Manager allows you to set up a default configuration that can be used for any RADIUS server that you configure the switch to communicate with. The default configuration includes:
•
•
•
•
About the Default RADIUS Server Encryption Type and Preshared Key
You need to configure the RADIUS preshared key to authenticate the switch to the RADIUS server. The length of the key is restricted to 64 characters and can include any printable ASCII characters (white spaces are not allowed). You can configure a global key to be used for all RADIUS server configurations on the switch.
You can override this global key assignment by explicitly using the key option when configuring an individual RADIUS server.
Configuring the Default RADIUS Server Encryption Type and Preshared Key
To configure the default RADIUS server encryption type and preshared key using Fabric Manager, follow these steps:
Step 1
You see the RADIUS configuration in the Information pane.
Step 2
You see the RADIUS default settings as shown in Figure 39-3.
Figure 39-3 RADIUS Default Settings
Step 3
Step 4
Step 5
Setting the Default RADIUS Server Timeout Interval and Retransmits
By default, a switch retries transmission to a RADIUS server only once before reverting to local authentication. You can increase this number up to a maximum of five retries per server. You can also configure the timeout value for the RADIUS server.
To configure the number of retransmissions and the time between retransmissions to the RADIUS servers using Fabric Manager, follow these steps:
Step 1
You see the RADIUS configuration in the Information pane.
Step 2
You see the RADIUS default settings.
Step 3
Step 4
About RADIUS Servers
You can add up to 64 RADIUS servers. RADIUS keys are always stored in encrypted form in persistent storage. The running configuration also displays encrypted keys. When you configure a new RADIUS server, you can use the default configuration or modify any of the parameters to override the default RADIUS configuration.
Configuring a RADIUS Server
To configure a RADIUS server and all its options using Fabric Manager, follow these steps:
Step 1
You see the RADIUS configuration in the Information pane.
Step 2
You see any existing RADIUS servers.
Step 3
You see the Create RADIUS Server dialog box shown in Figure 39-4.
Figure 39-4 Create RADIUS Server
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Configuring the Test Idle Timer
The test idle timer specifies the interval during which a RADIUS server receives no requests before the MDS switch sends out a test packet.
Note
To configure the test idle timer, see "Configuring a RADIUS Server" section.
Configuring Test User Name
You can configure a username and password for periodic RADIUS server status testing. You do not need to configure the test username and password to issue test messages to monitor RADIUS servers. You can use the default test username (test) and default password (test).
Note
To configure the optional username and password for periodic RADIUS server status testing, see "Configuring a RADIUS Server" section.
About Validating a RADIUS Server
As of Cisco SAN-OS Release 3.0(1), you can periodically validate a RADIUS server. The switch sends a test authentication to the server using the username and password that you configure. If the server does not respond to the test authentication, then the server is considered non responding.
Note
You can configure this option to test the server periodically, or you can run a one-time only test.
Periodically Validating a RADIUS Server
To configure the switch to periodically test a RADIUS server using Fabric Manager, follow these steps:
Step 1
You see the RADIUS configuration in the Information pane.
Step 2
You see any existing RADIUS servers.
Step 3
You see the Create RADIUS Server dialog box (see Figure 39-4).
Step 4
Step 5
Step 6
Step 7
Step 8
Displaying RADIUS Server Statistics
To display RADIUS server statistics using Fabric Manager, follow these steps:
Step 1
You see the RADIUS configuration in the Information pane.
Step 2
You see the RADIUS server statistics.
About Users Specifying a RADIUS Server at Login
By default, an MDS switch forwards an authentication request to the first server in the RADIUS server group. You can configure the switch to allow the user to specify which RADIUS server to send the authenticate request by enabling the directed request option. If you enable this option, the user can log in as username@hostname, where the hostname is the name of a configured RADIUS server.
Allowing Users to Specify a RADIUS Server at Login
To allow users logging into an MDS switch to select a RADIUS server for authentication using Fabric Manager, follow these steps:
Step 1
You see the RADIUS configuration in the Information pane.
Step 2
You see the RADIUS default settings.
Step 3
Step 4
About Vendor-Specific Attributes
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific attributes (VSAs) between the network access server and the RADIUS server. The IETF uses attribute 26. VSAs allow vendors to support their own extended attributes that are not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option using the format recommended in the specification. The Cisco vendor ID is 9, and the supported option is vendor type 1, which is named cisco-avpair. The value is a string with the following format:
protocol : attribute seperator value *Where protocol is a Cisco attribute for a particular type of authorization, separator is = (equal sign) for mandatory attributes, and * (asterisk) is for optional attributes.
When you use RADIUS servers to authenticate yourself to a Cisco MDS 9000 Family switch, the RADIUS protocol directs the RADIUS server to return user attributes, such as authorization information, along with authentication results. This authorization information is specified through VSAs.
VSA Format
The following VSA protocol options are supported by the Cisco SAN-OS software:
•
•
The following attributes are supported by the Cisco SAN-OS software:
•
shell:roles="network-admin vsan-admin"
shell:roles*"network-admin vsan-admin"
When an VSA is specified as shell:roles*"network-admin vsan-admin", this VSA is flagged as an optional attribute, and other Cisco devices ignore this attribute.
•
Specifying SNMPv3 on AAA Servers
The vendor/custom attribute cisco-av-pair can be used to specify user's role mapping using the format:
shell:roles="roleA roleB ..."If the roll option in the cisco-av-pair attribute is not set, the default user role is network-operator.
The VSA format optionally specifies your SNMPv3 authentication and privacy protocol attributes also as follows:
shell:roles="roleA roleB..." snmpv3:auth=SHA priv=AES-128The SNMPv3 authentication protocol options are SHA and MD5. The privacy protocol options are AES-128 and DES. If these options are not specified in the cisco-av-pair attribute on the ACS server, MD5 and DES are used by default.
Configuring TACACS+ Server Monitoring Parameters
A Cisco MDS switch uses the Terminal Access Controller Access Control System Plus (TACACS+) protocol to communicate with remote AAA servers. You can configure multiple TACACS+ servers and set timeout values.
This section includes the following topics:
•
•
•
•
•
•
•
•
•
About TACACS+
TACACS+ is a client/server protocol that uses TCP (TCP port 49) for transport requirements. All switches in the Cisco MDS 9000 Family provide centralized authentication using the TACACS+ protocol. The TACACS+ has the following advantages over RADIUS authentication:
•
•
•
About TACACS+ Server Default Configuration
Fabric Manager allows you to set up a default configuration that can be used for any TACACS+ server that you configure the switch to communicate with. The default configuration includes:
•
•
•
•
•
About the Default TACACS+ Server Encryption Type and Preshared Key
You need to configure the TACACS+ preshared key to authenticate the switch to the TACACS+ server. The length of the key is restricted to 64 characters and can include any printable ASCII characters (white spaces are not allowed). You can configure a global key to be used for all TACACS+ server configurations on the switch.
You can override this global key assignment by explicitly using the key option when configuring and individual TACACS+ server.
Setting the Default TACACS+ Server Encryption Type and Preshared Key
To configure the default TACACS+ server encryption type and preshared key using Fabric Manager, follow these steps:
Step 1
You see the TACACS+ configuration in the Information pane.
Step 2
Step 3
You see the TACACS+ default settings.
Step 4
Step 5
Setting the Default TACACS+ Server Timeout Interval and Retransmits
By default, a switch retries a TACACS+ server only once. This number can be configured. The maximum is five retries per server. You can also configure the timeout value for the TACACS+ server.
To configure the number of retransmissions and the time between retransmissions to the TACACS+ servers using Fabric Manager, follow these steps:
Step 1
You see the TACACS+ configuration in the Information pane.
Step 2
You see the TACACS+ default settings.
Step 3
Step 4
About TACACS+ Servers
By default, the TACACS+ feature is disabled in all switches in the Cisco MDS 9000 Family. Fabric Manager or Device Manager enables the TACACS+ feature automatically when you configure a TACACS+ server.
If a secret key is not configured for a configured server, a warning message is issued if a global key is not configured. If a server key is not configured, the global key (if configured) is used for that server.
Note
You can configure global values for the secret key for all TACACS+ servers.
Note
Configuring a TACACS+ Server
To configure a TACACS+ server and all its options using Fabric Manager, follow these steps:
Step 1
You see the TACACS+ configuration in the Information pane.
Step 2
You see any existing TACACS+ servers.
Step 3
You see the Create TACACS+ Server dialog box as shown in Figure 39-5.
Figure 39-5 Create TACACS+ Server Dialog Box
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
About Validating a TACACS+ Server
As of Cisco SAN-OS Release 3.0(1), you can periodically validate a TACACS+ server. The switch sends a test authentication to the server using the test username and test password that you configure. If the server does not respond to the test authentication, then the server is considered nonresponding.
Note
You can configure this option to test the server periodically, or you can run a one-time only test.
Periodically Validating a TACACS+ Server
To configure the switch to periodically test a TACACS+ server using Fabric Manager, see the "Configuring TACACS+ Server Monitoring Parameters" section.
Displaying TACACS+ Server Statistics
To display TACACS+ server statistics using Fabric Manager, follow these steps:
Step 1
You see the TACACS+ configuration in the Information pane.
Step 2
You see the TACACS+ server statistics.
About Users Specifying a TACACS+ Server at Login
By default, an MDS switch forwards an authentication request to the first server in the TACACS+ server group. You can configure the switch to allow the user to specify which TACACS+ server to send the authenticate request. If you enable this feature, the user can log in as username@hostname, where the hostname is the name of a configured TACACS+ server.
Allowing Users to Specify a TACACS+ Server at Login
To configure the switch to allow users to specify a TACACS+ server at login using Fabric Manager, follow these steps:
Step 1
You see the TACACS+ configuration in the Information pane.
Step 2
You see the TACACS+ default settings.
Step 3
Step 4
About Custom Attributes for Roles
Cisco MDS 9000 Family switches use the TACACS+ custom attribute for service shells to configure roles to which a user belongs. TACACS+ attributes are specified in name=value format. The attribute name for this custom attribute is cisco-av-pair. The following example illustrates how to specify roles using this attribute:
cisco-av-pair=shell:roles="network-admin vsan-admin"You can also configure optional custom attributes to avoid conflicts with non-MDS Cisco switches using the same AAA servers.
cisco-av-pair*shell:roles="network-admin vsan-admin"Additional custom attribute shell:roles are also supported:
shell:roles="network-admin vsan-admin"or
shell:roles*"network-admin vsan-admin"
Note
Supported TACACS+ Servers
The Cisco SAN-OS software currently supports the following parameters for the listed TACACS+ servers:
•
cisco-av-pair=shell:roles="network-admin"•
shell:roles="network-admin"shell:roles*"network-admin"cisco-av-pair*shell:roles="network-admin"cisco-av-pair*shell:roles*"network-admin"cisco-av-pair=shell:roles*"network-admin"•
cisco-av-pair*shell:roles="network-admin"cisco-av-pair=shell:roles*"network-admin"Server Groups
You can specify one or more remote AAA servers to authenticate users using server groups. All members of a group must belong to the same protocol, either RADIUS or TACACS+. The servers are tried in the same order in which you configure them.
The AAA server monitoring feature can mark an AAA server as dead. You can configure a period of time in minutes to elapse before the switch sends requests to a dead AAA server. (See the "AAA Server Monitoring" section.)
This section includes the following topics:
•
About Configuring Server Groups
You can configure these server groups at any time but they only take effect when you apply them to an AAA service. You configure AAA policies for CLI users or Fabric Manager or Device Manager users.
Configuring Server Groups
To configure a RADIUS or TACACS+ server group using Fabric Manager, follow these steps:
Step 1
You see the AAA configuration in the Information pane shown in Figure 39-6. If you do not see the screen in Figure 39-6, click the Server Groups tab.
You see the RADIUS or TACACS+ server groups configured.
Figure 39-6 AAA Server Groups
Step 2
You see the Create Server dialog box.
Step 3
Step 4
Step 5
Step 6
Step 7
You can associate a server group with all applications or you can specify certain applications.
Figure 39-7 Applications Tab
Step 8
About Bypassing a Nonresponsive Server
As of Cisco SAN-OS Release 3.0(1), you can bypass a nonresponsive AAA server within a server group. If the switch detects a nonresponsive server, it will bypass that server when authenticating users. Use this feature to minimize login delays caused by a faulty server. Instead of sending a request to a nonresponsive server and waiting for the authentication request to timeout, the switch sends the authentication request to the next server in the server group. If there are no other responding servers in the server group, the switch continues to attempt authentications against the nonresponsive server.
AAA Server Distribution
Configuration for RADIUS and TACACS+ AAA on an MDS switch can be distributed using the Cisco Fabric Services (CFS). The distribution is disabled by default (see Chapter 13, "Using the CFS Infrastructure").
After enabling the distribution, the first server or global configuration starts an implicit session. All server configuration commands entered thereafter are stored in a temporary database and applied to all switches in the fabric (including the originating one) when you explicitly commit the database. The various server and global parameters are distributed, except the server and global keys. These keys are unique secrets to a switch and should not be shared with other switches.
Note
This section includes the following topics:
•
•
•
•
•
•
Note
Enabling AAA Server Distribution
Only switches where distribution is enabled can participate in the distribution activity.
To enable RADIUS server distribution using Fabric Manager, follow these steps:
Step 1
You see the RADIUS configuration in the Information pane.
Step 2
Step 3
Step 4
To enable TACACS+ server distribution using Fabric Manager, follow these steps:
Step 1
You see the TACACS+ configuration in the Information pane.
Step 2
You see the TACACS+ CFS configuration.
Step 3
Step 4
Starting a Distribution Session on a Switch
A distribution session starts the moment you begin a RADIUS/TACACS+ server or global configuration. For example, the following tasks start an implicit session:
•
•
Note
Displaying the Session Status
Once the implicit distribution session has started, you can check the session status from Fabric Manager by expanding Switches > Security > AAA, and selecting RADIUS or TACACS+. You see the distribution status on the CFS tab.
Displaying the Configuration to be Distributed
To display the RADIUS or TACACS+ global and/or server configuration stored in the temporary buffer using Fabric Manager, follow these steps:
Step 1
Step 2
You see the distribution status on the CFS tab.
Step 3
Step 4
Step 5
Committing the Distribution
The RADIUS or TACACS+ global and/or server configuration stored in the temporary buffer can be applied to the running configuration across all switches in the fabric (including the originating switch).
To distribute a RADIUS or TACACS+ configuration using Fabric Manager, follow these steps:
Step 1
Step 2
Step 3
Step 4
Discarding the Distribution Session
Discarding the distribution of a session in progress causes the configuration in the temporary buffer to be dropped. The distribution is not applied.
To discard RADIUS or TACACS+ distribution using Fabric Manager, follow these steps:
Step 1
Step 2
Step 3
Step 4
Clearing Sessions
To clear a RADIUS or TACACS+ distribution using Fabric Manager, follow these steps:
Step 1
You see either the RADIUS or TACACS+ configuration in the Information pane.
Step 2
Step 3
Step 4
Merge Guidelines for RADIUS and TACACS+ Configurations
The RADIUS and TACACS+ server and global configuration are merged when two fabrics merge. The merged configuration is applied to CFS distribution-enabled switches.
When merging the fabric, be aware of the following conditions:
•
•
•
•
Caution
MSCHAP Authentication
Microsoft Challenge Handshake Authentication Protocol (MSCHAP) is the Microsoft version of CHAP. You can use MSCHAP for user logins to an MDS switch through a remote authentication server (RADIUS or TACACS+).
About Enabling MSCHAP
By default, the switch uses Password Authentication Protocol (PAP) authentication between the switch and the remote server. If you enable MSCHAP, you need to configure your RADIUS server to recognize the MSCHAP vendor-specific attributes. See the "About Vendor-Specific Attributes" section. Table 39-1 shows the RADIUS vendor-specific attributes required for MSCHAP.
Enabling MSCHAP Authentication
To enable MSCHAP authentication using Device Manager, follow these steps:
Step 1
You see the AAA configuration in the Information pane as shown in Figure 39-8.
Figure 39-8 AAA Configuration in Device Manager
Step 2
You see the MSCHAP configuration as shown in Figure 39-9.
Figure 39-9 MSCHAP Configuration
Step 3
Step 4
Local AAA Services
The system maintains the username and password locally and stores the password information in encrypted form. You are authenticated based on the locally stored user information. See the "Configuring Roles and Profiles" section on page 37-2.
You can turn off password verification using the none option. If you configure this option, users can log in without giving a valid password. But the user should at least exist locally on the Cisco MDS 9000 Family switch.
Caution
Refer to the Cisco MDS 9000 Family CLI Configuration Guide to configure this option.
Configuring Cisco Access Control Servers
The Cisco Access Control Server (ACS) uses TACACS+ and RADIUS protocols to provide AAA services that ensure a secure environment.When using the AAA server, user management is normally done using Cisco ACS. Figure 39-10, Figure 39-11, Figure 39-12, and Figure 39-13 display ACS server user setup configurations for network-admin roles and multiple roles using either RADIUS or TACACS+.
Caution
Figure 39-10 Configuring the network-admin Role When Using RADIUS
Figure 39-11 Configuring Multiple Roles with SNMPv3 Attributes When Using RADIUS
Figure 39-12 Configuring the network-admin Role with SNMPv3 Attributes When Using TACACS+
Figure 39-13 Configuring Multiple Roles with SNMPv3 Attributes When Using TACACS+
Default Settings
Table 39-2 lists the default settings for all switch security features in any switch.
