HP 10500 series, Security Configuration Manual, Page: 70 / 596

56
# Create a RADIUS scheme.
[Switch] radius scheme rad
# Specify the primary authentication server.
[Switch-radius-rad] primary authentication 10.1.1.1 1812
# Set the shared key for secure communication with the server to expert in plain text.
[Switch-radius-rad] key authentication simple expert
# Include domain names in the usernames sent to the RADIUS server.
[Switch-radius-rad] user-name-format with-domain
[Switch-radius-rad] quit
# Create ISP domain bbb and configure authentication, authorization, and accounting methods
for login users.
[Switch] domain bbb
[Switch-isp-bbb] authentication login radius-scheme rad
[Switch-isp-bbb] authorization login radius-scheme rad
[Switch-isp-bbb] accounting login none
[Switch-isp-bbb] quit
Verifying the configuration
# Initiate an SSH connection to the switch, and enter the username hello@bbb and the correct
password. The user logs in to the switch. (Details not shown.)
# Verify that the user can use the commands permitted by the network-operator user role. (Details
not shown.)
Authentication for SSH users by an LDAP server
Network requirements
As shown in Figure 16 , an LDAP server is located at 10.1.1.1/24 and uses the domain name
ldap.com .
Configure the switch to meet the following requirements:
•
Use the LDAP server to authenticate SSH users.
•
Assign the default user role network-operator to SSH users after they pass authentication.
On the LDAP server, set the administrator password to admin!123456 , add user aaa , and set the
user's password to ldap!123456 .
Figure 16 Network diagram
Configuration procedure
1. Configure the LDAP server: