topic Re: SZ / SCG Admin roles and AAA Servers - Priority? in SmartZone and Virtual SmartZone

SZ / SCG Admin roles and AAA Servers - Priority?

Greg_WiGuy — Wed, 05 Apr 2023 12:43:44 GMT

I'm looking through the documentation below trying to figure out if once we configure TACACS+, will the local accounts still be usable?

https://docs.commscope.com/bundle/sz-611-adminguide-sz100vsz/page/GUID-B9789B57-C58B-4215-A83A-AC05BA1458C4.html

For other network switches, routers, firewalls etc. we typically have a rule where the local accounts are not available unless the TACACS+ server becomes unreachable. This allows us to force admins to log in with their AAA credentials but in the event of a failure, we can fall back on the local account with a shared password. Is this possible with SZ?

Re: SZ / SCG Admin roles and AAA Servers - Priority?

Rohit_W — Fri, 07 Apr 2023 08:24:41 GMT

Hi Greg,

This is possible. Please refer to below article to configure the TACACS/TACACS+.
https://support.ruckuswireless.com/articles/000006566

Re: SZ / SCG Admin roles and AAA Servers - Priority?

Greg_WiGuy — Sat, 08 Apr 2023 19:17:11 GMT

Hi Rohit, this article looks like its for the ICX switches and not the SmartZone product.

Re: SZ / SCG Admin roles and AAA Servers - Priority?

Rohit_W — Mon, 10 Apr 2023 08:48:46 GMT

Hi Greg,

Please refer to below admin guide (page 661):

https://support.ruckuswireless.com/documents/4375-smartzone-6-1-1-lt-ga-administration-guide-sz100-vsz-e

Re: SZ / SCG Admin roles and AAA Servers - Priority?

Greg_WiGuy — Mon, 10 Apr 2023 13:19:34 GMT

Hi Rohit,
This looks similar to the guide link I posted in my initial question but does not address my question.

Re: SZ / SCG Admin roles and AAA Servers - Priority?

Greg_WiGuy — Tue, 11 Apr 2023 14:15:06 GMT

For anyone who comes across my post later on, here's the following answer I got from my sales engineer via some internal back-channeling.

the Local SZ accounts will remain usable. We don’t have an option to disable their use until connection to the AAA server is lost.

So basically, the local admin account will always be usable, and AAA just adds the ability to use other servers for authentication. My plan is now to use a complex password for admin that gets locked away and force all users to use their AAA creds.