3Com MSR 50 Series, Configuration Manual

Page: 1779 / 2443

Configuring HWTACACS 1779
Setting the Shared Key
for HWTACACS Packets
When using a HWTACACS server as an AAA server, you can set a key to secure the
communications between the device and the HWTACACS server.
The HWTACACS client and HWTACACS server use the MD5 algorithm to encrypt
packets exchanged between them and a shared key to verify the packets. Only
when the same key is used can they properly receive the packets and make
responses.
Follow these steps to set the shared key for HWTACACS packets:
Configuring Attributes
Related to the Data Sent
to the TACACS Server
Follow these steps to configure the attributes related to the data sent to the
HWTACACS server:
n
■
If a HW TACACS server does not support a username with the domain name,
you can configure the device to remove the domain name before sending the
username to the server.
■
The nas-ip command in HWTACACS scheme view is only for the current
HWTACACS scheme, while the hwtacacs nas-ip command in system view is
for all HWTACACS schemes. However, the nas-ip command in HWTACACS
scheme view overwrites the configuration of the hwtacacs nas-ip command.
To do... Use the command... Remarks
Enter system view system-view -
Create a HWTACACS scheme and
enter HWTACACS scheme view hwtacacs scheme
hwtacacs-scheme-name
Required
By default, no HWTACACS
scheme is created.
Set the shared keys for
HWTACACS authentication,
authorization, and accounting
packets key { accounting |
authentication |
authorization } string
Required
By default, no shared key is
set.
To do... Use the command... Remarks
Enter system view system-view -
Create a HWTACACS scheme
and enter HWTACACS scheme
view hwtacacs scheme
hwtacacs-scheme-name
Required
By default, no HWTACACS
scheme is created.
Specify the format of the
username to be sent to a
HWTACACS server user-name-format
{ with-domain |
without-domain }
Optional
By default, the ISP domain
name is included in the
username.
Specify the unit for data flows
or packets to be sent to a
HWTACACS server data-flow-format { data
{ byte | giga-byte |
kilo-byte | mega-byte } |
packet { giga-packet |
kilo-packet | mega-packet |
one-packet } } *
Optional
The defaults are as follows:
Byte for data flows, and
One-packet for data packets.
Set the source
IP address of
the device to
send
HWTACACS
packets In
HWTACACS
scheme view nas-ip ip-address Use either command
By default, the outbound port
serves as the source IP
address to send HWTACACS
packets
In system view quit
hwtacacs nas-ip ip-address