Users Guide

Management Authentication
Users who need to access the controller to monitor, manage, or configure the Dell user-centric network can be
authenticated with RADIUS, TACACS+, or LDAP servers or the internal database.
Only user record attributes are returned upon successful authentication. Therefore, to derive a
management role other than the default mgmt auth role, set the server derivation rule based on the user
attributes.
Using the WebUI
1. Navigate to the Configuration > Management > Administration page.
2. Under the Management Authentication Servers section, select the following:
l Enable check box
l Server Group
3. Click Apply.
Using the CLI
(host)(config) #aaa authentication mgmt
server-group <group>
enable
Accounting
You can configure accounting for RADIUS and TACACS+ server groups.
RADIUS or TACACS+ accounting is only supported when RADIUS or TACACS+ is used for authentication.
RADIUS Accounting
RADIUS accounting allows user activity and statistics to be reported from the controller to RADIUS servers:
1. The controller generates an Accounting Start packet when a user logs in. The code field of transmitted
RADIUS packet is set to 4 (Accounting-Request). Note that sensitive information, such as user passwords,
are not sent to the accounting server. The RADIUS server sends an acknowledgement of the packet.
2. The controller sends an Accounting Stop packet when a user logs off; the packet information includes
various statistics such as elapsed time, input and output bytes, and packets. The RADIUS server sends an
acknowledgment of the packet.
The following is the list of attributes that the controller can send to a RADIUS accounting server:
l Acct-Status-Type: This attribute marks the beginning or end of accounting record for a user. Current
values are Start, Stop, and Interim Update.
l User-Name: Name of user.
l Acct-Session-Id: A unique identifier to facilitate matching of accounting records for a user. It is derived
from the user name, IP address, and MAC address. This is set in all accounting packets.
l Acct-Authentic: This indicates how the user was authenticated. Current values are 1 (RADIUS), 2 (Local),
and 3 (LDAP).
l Acct-Session-Time: The elapsed time, in seconds, that the client was logged in to the controller. This is
only sent in Accounting-Request records, where the Acct-Status-Type is Stop or Interim Update.
l Acct-Terminate-Cause: Indicates how the session was terminated and is sent in Accounting-Request
records where the Acct-Status-Type is Stop. Possible values are:
1: User logged off
Dell Networking W-Series ArubaOS 6.5.x | User Guide Authentication Servers | 199