52
To do…
Use the command…
Remarks
3.
Specify the primary
HWTACACS accounting server
primary accounting
ip-address
[
port-number
|
vpn-instance
vpn-instance-name
] *
Required
Configure at least one of the
commands
No accounting server by default
4.
Specify the secondary
HWTACACS accounting server
secondary accounting
ip-
address
[
port-number
|
vpn-
instance
vpn-instance-name
] *
5.
Enable the switch to buffer stop-
accounting requests getting no
responses
stop-accounting-buffer
enable
Optional
Enabled by default
6.
Set the maximum number of
stop-accounting request
transmission attempts
retry stop-accounting
retry-
times
Optional
100 by default
•
It is recommended to specify only the primary HWTACACS accounting server if backup is not required.
•
If both the primary and secondary accounting servers are specified, the secondary one is used when the
primary one is not reachable.
•
The IP addresses of the primary and secondary accounting servers cannot be the same. Otherwise, the
configuration fails.
•
You can remove an accounting server only when no active TCP connection for sending accounting
packets is using it.
•
Currently, HWTACACS does not support keeping accounts on FTP users.
Setting the shared key for HWTACACS packets
When using an HWTACACS server as an AAA server, you can set a key to secure the
communications between the switch and the HWTACACS server.
The HWTACACS client and HWTACACS server use the MD5 algorithm to encrypt packets
exchanged between them and a shared key to verify the packets. Only when the same key is used
can they properly receive the packets and make responses.
Follow these steps to set the shared key for HWTACACS packets:
To do…
Use the command…
Remarks
1.
Enter system view
system-view
—
2.
Enter HWTACACS scheme view
hwtacacs scheme
hwtacacs-scheme-
name
—
3.
Set the shared keys for HWTACACS
authentication, authorization, and
accounting packets
key
{
accounting
|
authentication
|
authorization
}
string
Required
No shared key exists by
default.
