3Com Switch 7754, Configuration Manual

Page: 534 / 940

534 C
HAPTER
49: AAA & RADIUS & HWTACACS C
ONFIGURATION
c
CAUTION:
■
The primary and secondary accounting servers cannot use the same IP address.
Otherwise, the system will prompt unsuccessful configuration.
■
You can remove a server only when it is not used by any active TCP connection
for sending accounting packets.
Configuring Shared Keys
for RADIUS Packets
When using a TACACS server as an AAA server, you can set a key to improve the
communication security between the router and the TACACS server.
The TACACS client and server adopt MD5 algorithm to encrypt the exchanged
HWTACACS packets. The two parties verify the validity of the exchanged packets
by using the shared keys that have been set on them, and can accept and respond
to the packets sent from each other only if both of them have the same shared
keys.
Create a HWTACACS
scheme and enter its view hwtacacs scheme
hwtacacs-scheme-name
Required
By default, no HWTACACS
scheme exists.
Set the IP address and port
number of the primary
TACACS accounting server primary accounting ip-address
[ port ]
Required
By default, the IP address of
the primary accounting
server is 0.0.0.0, and the
port number is 0.
Set the IP address and port
number of the secondary
TACACS accounting server secondary accounting
ip-address [ port ]
Required
By default, the IP address of
the secondary accounting
server is 0.0.0.0, and the
port number is 0.
Enable the stop-accounting
packets retransmission
function and set the
maximum number of
attempts retry stop-accounting
retry-times
Optional
By default, the
stop-accounting packets
retransmission function is
enabled and the system can
transmit a stop-accounting
request for 100 times.
Table 421 Configure HWTACACS accounting servers
Operation Command Description
Table 422 Configure shared keys for TACACS packets
Operation Command Description
Enter system view system-view -
Create a HWTACACS
scheme and enter its
view hwtacacs scheme
hwtacacs-scheme-name
Required
By default, no HWTACACS scheme
exists.
Set a shared key for
the HWTACACS
accounting/authentica
tion/authorization
packets key { accounting |
authorization |
authentication } string
Required
By default, the TACACS server does
not have a key.