Nach dem Update auf AOS 8.7R1 mit dem „aaa switch-access mode enhanced“ kann man sich als „admin“ bei der nächsten Anmeldung erst einmal wundern.

aaa-Konfiguration:

-> show configuration snapshot aaa
! AAA:
aaa radius-server "freeradius" host 192.168.2.134 hash-key <hash-key> hash-salt <hash-salt> retransmit 3 timeout 2 auth-port 1812 acct-port 1813 vrf-name default 
aaa authentication default "local" 
aaa authentication console "local" 
aaa authentication ssh "freeradius" 
aaa switch-access mode enhanced

aaa tacacs command-authorization disable

nach der Anmeldung und versuch working/certified zu synchronisieren

BennyE@mbp ~ % ssh admin@192.168.2.174
Password: 
 ________  ________  ________           ________  ________     
|\   __  \|\   __  \|\   ____\         |\   __  \|\   __  \    
\ \  \|\  \ \  \|\  \ \  \___|_        \ \  \|\  \ \  \|\  \   
 \ \   __  \ \  \\\  \ \_____  \        \ \   _  _\ \   __  \  
  \ \  \ \  \ \  \\\  \|____|\  \        \ \  \\  \\ \  \|\  \ 
   \ \__\ \__\ \_______\____\_\  \        \ \__\\ _\\ \_______\
    \|__|\|__|\|_______|\_________\        \|__|\|__|\|_______|
                       \|_________|                            
						OmniSwitch 6465                                                               
-> 
-> show running-directory 

CONFIGURATION STATUS
  Running CMM              : MASTER-PRIMARY,
  CMM Mode                 : VIRTUAL-CHASSIS MONO CMM,
  Current CMM Slot         : CHASSIS-1 A,
  Running configuration    : WORKING,
  Certify/Restore Status   : CERTIFY NEEDED
SYNCHRONIZATION STATUS
  Running Configuration    : NOT SYNCHRONIZED

-> copy running certified flash-synchro 
ERROR: Authorization failed. No functional privileges for this command.

-> 
-> write memory flash-synchro 
ERROR: Authorization failed. No functional privileges for this command.

-> show microcode working 
   /flash/working
   Package           Release                 Size     Description
-----------------+-------------------------+---------+-----------------------------------
Nos.img           8.7.280.R01               219318748 Alcatel-Lucent OS

Ausgabe von freeradius -X

(14) Sent Access-Accept Id 1 from 192.168.2.134:1812 to 192.168.2.174:39464 length 0
(14)   Xylan-Asa-Access = "all"
(14)   Xylan-Acce-Priv-F-W1 = 0xffffffff
(14)   Xylan-Acce-Priv-F-W2 = 0xffffffff

Typische Radius-Konfiguration (es fehlen die Attribute 3 und 4)

benny@tiger:/usr/share/freeradius$ sudo vi /etc/freeradius/3.0/users

# ...
admin           Cleartext-Password := "SicheresPasswort0815"
                Xylan-Asa-Access = "all",
                Xylan-Acce-Priv-F-W1 = 0xFFFFFFFF,
                Xylan-Acce-Priv-F-W2 = 0xFFFFFFFF
# ...