Ldap para administracion de Switches catalyst 3850 o 9300

[yabelcn]

Buen día, he leído varios foros en donde dicen que prácticamente es imposible configurar un servidor Ldap y usarlo para acceso a los switches como metodo de administracion, aunque las fechas son de hace varios años ya, entonces me gustaria saber si alguien tiene informacion fresca respecto a este tema, o si a la actualidad aun no se puede utilizar ese protocolo como metodo de autenticacion a los switches .

[Greg Gibbs]

-- From Google Translate --

"Good morning, I have read several forums where they say that it is practically impossible to configure an Ldap server and use it to access the switches as a management method, although the dates are from several years ago, so I would like to know if anyone has fresh information regarding to this topic, or if at present this protocol still cannot be used as an authentication method for switches."

[Greg Gibbs · Accepted solution]

Cisco switches, like most other vendors, cannot interact directly with an LDAP server for authentication of device administrators. The switch would need to be configured for authentication/authorization against a TACACS+/RADIUS AAA server (like Cisco ISE) which would use the LDAP/AD server as an external identity store to authenticate and authorize the admin users. This has been common practice for over a decade and is unlikely to change.

For ISE, you can find more information and examples in the Cisco ISE Device Administration Prescriptive Deployment Guide 

[thomas · Accepted solution]

We also have many guides about ISE LDAP support @ https://cs.co/ise-guides#LDAP