Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

Elmar Knipp
Advisor

Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

I have successfully configured user authentication for this switch with my Radius server. I want to give these users the admin role.

When these users log in, they only have the users role. The follwing message is displayed after a login with telnet:

Switch role not specified, use default.

My radius server sents back the flag

AVP: l=6 t=Service-Type(6): Administrative-User(6)

(checked with wireshark packet sniffer) but the switch seams to ignore this.

How can I configure the admin role?
8 REPLIES
cenk sasmaztin
Honored Contributor

Re: Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

are you want configure admin role users

you must be go to active directory server and go active directort users and computers in this page you see user account.

for make change role account (user or admin)
you make double clik on user and go to member of tab and attach this user administrator group on server

cenk
cenk

Elmar Knipp
Advisor

Re: Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

Cent,

many thanks for the answer.

My radius server is not an Microsoft Active Directory Server. It is a RSA SecurID system, which has a built in radius server. I have made the analog configuration as you proposed with AD. And as written in my first post, the servers answers with the flag "Administrative-User(6)" (which is defined in the RFC).

So why is the switch not using this flag?

Regards,
Elmar
cenk sasmaztin
Honored Contributor

Re: Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

hi Elmar sorry I now understand
please send me your switch show tech command print.

cenk
cenk

Elmar Knipp
Advisor

Re: Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

Cent,

you are speaking of the command "configshow" of the switch? I can run also a "supportshow" but the output is 1,5 MBytes long ;-)

I have XXXXX-ed the radius secrets.

Elmar
cenk sasmaztin
Honored Contributor

Re: Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

hi Elmar
are you make speak which switch model ?

cenk
cenk

cenk sasmaztin
Honored Contributor

Re: Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

sorry Elmar you have switch hp san switch I'm Procurve expert sorry ..
I'm not you help

cenk
cenk

Mike Celone
Frequent Advisor

Re: Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

Elamr I am attempting to do the same thing. Where you ever able to get this figured out?
Mike
André Beck
Honored Contributor

Re: Radius and Brocade 4Gb SAN Switch for HP c-Class BladeSystem

Hi Elmar,

on Cisco IOS there is a similar pitfall in that configuring authentication (aaa authentication ...) is sufficient to get a login, but in order to actually get an elevated permission profile, you have to add authorization statements as well (aaa authorization ...). But the config you posted doesn't look like anything I've ever seen before and

> auth.policy:0
> auth.policy.dev:3

doesn't even reveal which of the first two As of AAA it's talking about or how it links to the configured RADIUS servers. So I can't help much but to point into this direction: look out for additional non-obvious authorization-related config options.

HTH,
Andre.