Do you get nuts about these user-names and passwords you need to remember across all these different systems, platforms and applications. LDAP or RADIUS is your friend. When you make a mistake however it can also be you biggest enemy.
Brocade offers you the option to hook up a switch to LDAP or RADIUS for central authentication. (only Authentication).
An incorrectly configured LDAP or RADIUS configuration on a Brocade switch may lock out network access. This applies to telnet, ssh, webtools and SMI-S.
When AAA configuration is done via the CLI it is very important to specify the correct parameters and specifically the double quotation marks. If ldap is configured with the local database as fall-back the command would be aaaconfig –authspec “ldap;local”. If the quotation marks are omitted the semicolon will be interpreted as a command-line separator. (These commands are executed in a so called restricted Linux bash shell and as such have to abide the rules according to this shell) In essence two commands will then be executed separately.
aaaconfig –authspec ldap
local
The first command will succeed and change the authentication method to LDAP and will immediately logout all logged in users. If LDAP is incorrectly configured all authentication requests will fail and network access is not possible.
To fix this you will need to attach a serial cable to the switch (or Active CP)
- Connect the serial cable to the switch serial management port. (On a blade system like DCXX or 48000 connect to the active CP)
- Login with either root or admin account. (Console access is still allowed).
- Modify the AAA configuration with the command aaaconfig –authspec “ldap;local”.
- Depending on the ldap authentication timeout settings the login will fall back to the local user-database for authentication.
Cheers,
Erwin
