3Com Switch 8807, Configuration Manual

Page: 256 / 883

256 C
HAPTER
26: AAA
AND
RADIUS/HWTACACS P
ROTOCOL
C
ONFIGURATION
By default, the IP address of local RADIUS authentication server group is 127.0.0.1
and the password is 3Com.
When using local RADIUS server function, note that,
1 The number of UDP port used for authentication/authorization is 1645 and that
for accounting is 1646.
2 The password configured by local-server command must be the same as that of
the RADIUS authentication/authorization packet configured by the command key
authentication in radius scheme view.
3 Switch 8800 Family series serving as local RADIUS authentication servers currently
only support the CHAP and PAP authentication modes; they do not support the
MD5-challenge mode.
Configuring
HWTACACS Protocol
The following sections describe HWTACACS configuration tasks.
■
“Creating a HWTACAS Scheme”
■
“Configuring HWTACACS Authentication Servers”
■
“Configuring HWTACACS Authorization Servers”
■
“Configuring HWTACACS Accounting Servers and the Related Attributes”
■
“Configuring the Source Address for HWTACACS Packets Sent by NAS”
■
“Setting a Key for Securing the Communication with TACACS Server”
■
“Setting the Username Format Acceptable to the TACACS Server”
■
“Setting the Unit of Data Flows Destined for the TACACS Server”
■
“Setting Timers Regarding TACACS Server”
n
Pay attention to the following when configuring a TACACS server:
■
HWTACACS server does not check whether a scheme is being used by users
when changing most of HWTACS attributes, unless you delete the scheme.
■
By default, the TACACS server has no key.
In the above configuration tasks, creating HWTACACS scheme and configuring
TACACS authentication/authorization server are required; all other tasks are
optional and you can determine whether to perform these configurations as
needed.
Creating a HWTACAS
Scheme
As aforementioned, HWTACACS protocol is configured scheme by scheme.
Therefore, you must create a HWTACACS scheme and enter HWTACACS view
before you perform other configuration tasks.
Perform the following configuration in system view.
Table 228 Create/Delete a local RADIUS authentication server
Operation Command
Create a local RADIUS authentication server local-server nas-ip ip - address key password
Delete a local RADIUS authentication server undo local-server nas-ip ip - address