Hi,
We want do some rest stuff. This is al working fine on our 3810 switches but it fails on our 2920 switches. After some digging into the problem I found out that the 2920 series do not have a REST access task in the authentication list. If I user the built in manager user on both switches it works fine however if I use a local user it failes.
This is my local user on both switches:
aaa authentication local-user "restuser" group "Level-15"
This is the result on the 2920 series (it works fine on the 3810 and I doublechecked the passwords):
W 01/05/21 08:09:33 05008 http: Invalid user name/password on the REST session;
the user 'restuser' is trying to login.
On the 3810 I have an option the set the authentication source for the REST task:
Aruba JL071A 3810M-24G-1-slot Switch
Software revision KB.16.10.0011
# show authentication
Status and Counters - Authentication Information
Authorized enabled as backup for secondary login are preceded by *
Login Attempts : 3
Lockout Delay : 0
Respect Privilege : Disabled
Bypass Username For Operator and Manager Access : Disabled
| Login Login Login
Access Task | Primary Server Group Secondary
-------------- + ----------- ------------ ----------
Console | Local None
Telnet | Local None
Port-Access | Local None
Webui | Local None
SSH | Local None
Web-Auth | ChapRadius radius None
MAC-Auth | ChapRadius radius None
SNMP | Local None
Local-MAC-Auth | Local None
REST | Local None
| Enable Enable Enable
Access Task | Primary Server Group Secondary
-------------- + ----------- ------------ ----------
Console | Local None
Telnet | Local None
Webui | Local None
SSH | Local None
REST | Local None
However on the 2920 this is missing:
HP J9729A 2920-48G-POE+ Switch
Software revision WB.16.10.0010
# show authentication
Status and Counters - Authentication Information
Login Attempts : 3
Lockout Delay : 0
Respect Privilege : Disabled
Bypass Username For Operator and Manager Access : Disabled
| Login Login Login
Access Task | Primary Server Group Secondary
-------------- + ----------- ------------ ----------
Console | Local None
Telnet | Local None
Port-Access | Local None
Webui | Local None
SSH | Local None
Web-Auth | ChapRadius radius None
MAC-Auth | ChapRadius radius None
SNMP | Local None
Local-MAC-Auth | Local None
| Enable Enable Enable
Access Task | Primary Server Group Secondary
-------------- + ----------- ------------ ----------
Console | Local None
Telnet | Local None
Webui | Local None
SSH | Local None
Does anybody know I can use local users for REST tasks on a 2920? The option REST is also missing in the CLI:
(config)# aaa authentication
allow-vlan Configure authenticator ports to apply VLAN changes immediately.
captive-portal Configure redirection to a captive portal server for additional client authentication.
console Configure authentication mechanism used to control access to the switch console.
disable-username Bypass the username during authentication while accessing the switch to get Manager or Operator access.
local-user Create or remove a local user account.
lockout-delay The number of seconds after repeated login failures before a user may again attempt login.
login Specify that switch respects the authentication server's privilege level.
mac-based Configure authentication mechanism used to control mac-based port access to the switch.
num-attempts The number of login attempts allowed.
port-access Configure authentication mechanism used to control access to the network.
ssh Configure authentication mechanism used to control SSH access to the switch.
telnet Configure authentication mechanism used to control Telnet access to the switch.
unlock Unlock the locked user only when the user-based-lockout is enabled.
user-based-lockout Locking users based on the username.
web Configure authentication mechanism used to control web access to the switch.
web-based Configure authentication mechanism used to control web-based port access to the switch.