41
•
If both the primary and secondary accounting servers are specified, the secondary one is used when the
primary one is not reachable.
•
In practice, you may specify one RADIUS server as the primary accounting server, and up to 16 RADIUS
servers as the secondary accounting servers, or specify a server as the primary accounting server for a
scheme and as the secondary accounting servers for another scheme at the same time. In addition,
because a RADIUS server uses different UDP ports to receive authentication/authorization and
accounting packets, the port for authentication/authorization must be different from that for accounting.
•
You can set the maximum number of stop-accounting request transmission buffer, allowing the switch to
buffer and resend a stop-accounting request until it receives a response or the number of transmission
retries reaches the configured limit. In the latter case, the switch discards the packet.
•
If you delete an accounting server servicing users, the switch cannot send stop-accounting requests for the
users to that server any more, and does not buffer the requests.
•
You can set the maximum number of accounting request transmission attempts on the switch, allowing the
switch to disconnect a user when the number of accounting request transmission attempts for the user
reaches the limit but it still receives no response to the accounting request.
•
The IP addresses of the primary and secondary accounting servers must be different from each other.
Otherwise, the configuration fails.
•
Currently, RADIUS does not support keeping accounts on FTP users.
•
All servers for authentication/authorization and accountings, primary or secondary, must use IP
addresses of the same IP version.
Specifying the shared keys for RADIUS packets
The RADIUS client and RADIUS server use the MD5 algorithm to encrypt packets exchanged
between them and use shared keys to verify the packets. Only when the same keys are used can
they properly receive the packets and make responses.
A shared key specified during the configuration of the RADIUS server takes precedence. A shared
key specified in this task takes effect only if no corresponding shared key is specified during the
RADIUS server configuration.
Follow these steps to specify the shared keys for RADIUS packets:
To do…
Use the command…
Remarks
1.
Enter system view
system-view
—
2.
Enter RADIUS scheme view
radius scheme
radius-scheme-
name
—
3.
Specify the shared key for
RADIUS
authentication/authorization or
accounting packets
key
{
accounting
|
authentication
}
string
Required
No key by default
The shared key specified on the switch must be the same as that specified on the RADIUS server.
