2.1.10 Radware - BlueCat Infrastructure Assurance - 25.2.0

BlueCat LiveAssurance User Guide
ft:locale
en-US
Product name
BlueCat Infrastructure Assurance
Version
25.2.0
Note: We always recommend a system administrator defer to the vendor’s official documentation on credential creation. Please follow the vendor’s instructions for configuring the device for access with an ssh key, and then use the LiveAssurance WebGUI to store the Private key in the relevant Credential Profile.

Determining which Account Type to Set Up

By default, admin privileges are created for all Alteon devices. However, please see the below on recommended configuration for the LiveAssurance user.
Version Authentication Authorization Required User Type
Alteon - OS 29.0 and later Remote or Local Remote or Local Administrator role

Setting up the LiveAssurance User Account:

Note: Up to 10 users can be created at any time.

Creating a Local Account via CLI:

  1. To enter into user configuration, type the following: /cfg/sys/access/user/uid <#>

    1. Create the user name: "name"

    2. Change the password: "pswd"

    3. Establish the privilege level: "cos admin"

  2. Type enable

  3. Type apply

Creating a New Local Administrator Account in Alteon:

  1. In the directory on the left, select Users > Local Users. Select the + symbol

  2. To create the correct user for LiveAssurance, you need to:

    1. Enable the User.

    2. Define the User ID , User Name, User Roles (administrator only) and define the new password.
      Note: Up to 11 credentials can be defined at a time

    3. Optional Configuration: You can enable fallback to RADIUS/TACACS should the local database fail at any point. This allows Radware to communicate with the RADIUS/TACACS server configured for authentication/authorization. Please read the Alteon application user guide to properly configure this.

  3. After configuring the user, click on Submit

  4. Click on Apply and Save to save your configurations. Make sure you are not accidentally making any additional changes to the devices. You can identify this by clicking on the Diff button on the top right.

Configuring the administrator account for remote authentication (RADIUS/TACACS)

For both RADIUS and TACACS:

  1. To configure the Alteon to communicate with a RADIUS and TACACs server over the web GUI, select Remote Authentication which is just below Local Users

  2. Make sure to configure the fields required for your RADIUS/TACACs server as the only way to test if the server connected is SSH using the new configurations.

Radius Authentication Only:

Ensure that the credentials used have the correct RADIUS attribute. For administrator privileges, the default attribute “6” works just fine.

TACACs Authentication Only:

TACACS+ uses the AAA architecture, which separates Authentication, Authorization, and Accounting. This allows separate authentication solutions that can still use TACACS+ for authorization and accounting.

For example, with TACACS+, it is possible to use Kerberos authentication and TACACS+ authorization and accounting. After Alteon authenticates a user on a Kerberos server, it requests authorization information from a TACACS+ server without requiring re-authentication. Alteon informs the TACACS+ server that it has successfully authenticated the user on a Kerberos server and the server then provides authorization information.

TACACS Disclaimer

Alteon supports ASCII inbound logins, however, the following are not supported:

  1. PAP, CHAP, and ARAP login methods.

  2. TACACS+ change password requests.

  3. One-time password authentication

For TACACS Authorization, privilege level differs in the following scenarios:

  • Disabled Privilege Level Mapping. TACACs+ Level should be set to 6

  • Enabled Privilege Level Mapping. TACACs+ Level should be set to 14 or 15

Frequently Asked Questions

Why does LiveAssurance need administrator access?

The Alteon devices are heavily restricted from viewing data outside each privilege levels. Privileges are designed around what may be configured on the load balancers.

For example, networking has only access to L2-L3 configurations of the Alteon while the “server operator” privileges can only view configurations involving the application servers that LiveAssurance is connected to. This separation makes it difficult to utilize one account to view all level of data unless utilizing administrator privilege.

LiveAssurance is strictly read-only. We do not execute any changes against the device.