H3C S5500-SI Series, Operation Manual

Page: 580 / 1217

1-36
To do… Use the command… Remarks
Clear HWTACACS statistics
reset hwtacacs statistics
{ accounting | all | authentication |
authorization }
Available in user view
Clear buffered stop-accounting
requests that get no responses
reset stop-accounting-buffer
hwtacacs-scheme
hwtacacs-scheme-name
Available in user view
AAA Configuration Examples
AAA for Telnet Users by a HWTACACS Server
Network requirements
As shown in Figure 1-7 , configure the switch to use the HWTACACS server to provide authentication,
authorization, and accounting services to login users.
z
The HWTACACS server is used for authentication, authentication, and accounting. Its IP address
is 10.1.1.1.
z
On the switch, set the shared keys for authentication, authorization, and accounting packets to
expert . Configure the switch to remove the domain name from a user name before sending the
user name to the HWTACACS server.
z
On the HWTACACS server, set the shared keys for packets exchanged with the switch to expert .
Figure 1-7 Configure AAA for Telnet users by a HWTACACS server
Internet
Switch
Telnet user
Authentication/Accounting server
10.1.1.1/24
Configuration procedure
# Configure the IP addresses of the interfaces (omitted).
# Enable the Telnet server on the switch.
<Switch> system-view
[Switch] telnet server enable
# Configure the switch to use AAA for Telnet users.
[Switch] user-interface vty 0 4
[Switch-ui-vty0-4] authentication-mode scheme
[Switch-ui-vty0-4] quit
# Configure the HWTACACS scheme.