NSG 9000-6G - Harmonic Inc

Chapter 3 Configuring Platform Parameters
Device Authentication
3.9 Device Authentication
NSG 9000 may use a Remote Authentication Dial In User Service (RADIUS) server to
authenticate and authorize users who are trying to log into the NSG 9000.
To enable the RADIUS authentication, the following should apply:
• Connection to a RADIUS server - NSG is defined as a client of the RADIUS server
• NSG 9000 is configured to work in Remote mode
• The RADIUS server database should include three types of authorized NSG users. Any
user defined in the RADIUS server must belong to one of these groups:
Admin
Config
Guest
The following table lists the permissions of each group of users:
Table 3-3: NSG 9000 Permission per Users
User
Device
Configuration
Change IP
Tables
Password of
Local Users
Upgrade
Authentication
Mode
Monitoring
admin Yes Yes Yes Yes Yes Yes
config Yes No No No No Yes
guest No No No No No Yes
Once a user is trying to log into the NSG 9000 either via HTTP/HTTPS or SSH, NSG 9000
challenges the RADIUS server. Once the user is authenticated and authorized, the user can
log into the device.
Upon a communication problem with the RADIUS server, while performing authentication,
the NSG automatically switches to a local authentication method. However, once the problem
is fixed, remote authentication is performed as long as Remote is the configured
authentication mode.
When working in Remote mode, local users cannot login.
To configure RADIUS Mode
1. Open the web client of the device.
2. Select Platform > Chassis > Authentication tab:
3. Open the Authentication Type list and select either of the following:
Local - authentication and authorization is performed locally, against the database of
the NSG 9000-6G
Remote-RADIUS - authentication and authorization is performed by the RADIUS
server. When selected, move to the following step to configure the required
parameters.
© 2012 Harmonic Inc. 34 NSG 9000-6G, Version 2.7, Rev B