3Com 3CR17660-91, Configuration Manual

Page: 195 / 422

RADIUS Configuration 181
CAUTION:
■
In an actual network environment, you can either specify two RADIUS servers as
the primary and secondary accounting servers respectively, or specify only one
server as both the primary and secondary accounting servers. In addition, because
RADIUS adopts different UDP ports to transceive the authentication/authorization
packets and the accounting packets, you must set a port number for accounting
different from that set for authentication/authorization.
■
Stop-accounting requests are critical to billing and will eventually affect the
charges of the users; they are important for both the users and the ISP. Therefore,
the switch should do its best to transmit them to the RADIUS accounting server. If
the RADIUS server does not respond to such a request, the switch should first
buffer the request on itself, and then retransmit the request to the RADIUS
accounting server until it gets a response, or the maximum number of
transmission attempts is reached (in this case, it discards the request).
■
You can set the maximum number of real-time accounting request attempts that
bring no response. If the switch makes all the allowed real-time accounting
request attempts but does not get any answer, it cuts down the connection of the
user.
■
The IP address and the port number of the default primary accounting server
“system” are 127.0.0.1 and 1646.
■
Currently, RADIUS does not support the accounting of FTP users.
Configuring Shared
Keys for RADIUS
Packets
The RADIUS client and server adopt MD5 algorithm to encrypt the RADIUS packets
exchanged with each other. The two parties verify the validity of the exchanged
packets by using the shared keys that have been set on them, and can accept and
respond to the packets sent from each other only if both of them have the same
shared keys.
Set the maximum
number of continuous
no-response real-time
accounting requests retry realtime-accounting
retry-times
Optional
By default, the switch is allowed to
continuously send at most 10 real-time
accounting requests if it gets no
response.
Table 144 Configure RADIUS accounting server (Continued)
Operation Command Description
Table 145 Configure shared keys for RADIUS packets
Operation Command Description
Enter system view system-view —
Create a RADIUS
scheme and enter its
view radius scheme
radius-scheme-name
Required
By default, a RADIUS scheme named
“system” has already been created in
the system.
Set a shared key for
the RADIUS
authentication/authori
zation packets key authentication string Required
By default, the shared key for the
RADIUS authentication/authorization
packets is “3Com”.
Set a shared key for
the RADIUS accounting
packets key accounting string Required
By default, the shared key for the
RADIUS accounting packets is “3Com”.