24
.
NOTE:
The maximum number of transmission attempts of RADIUS packets multiplied by the RADIUS server response
timeout period cannot be greater than 75 seconds.
For more information about the RADIUS server response timeout period, see “
Setting timers for controlling
communication with RADIUS servers
Setting the supported RADIUS server type
The supported RADIUS server type determines the type of the RADIUS protocol that the device uses to
communicate with the RADIUS server. It can be standard or extended:
Standard—Uses the standard RADIUS protocol, compliant to RFC 2865 and RFC 2866 or later.
Extended—Uses the proprietary RADIUS protocol of HP.
When the RADIUS server runs iMC, you must set the RADIUS server type to
extended
. When the RADIUS
server runs third-party RADIUS server software, either RADIUS server type applies. For the device to
function as a RADIUS server to authenticate login users, you must set the RADIUS server type to
standard
.
Follow these steps to set the RADIUS server type:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter RADIUS scheme view
radius scheme
radius-scheme-
name
—
Set the RADIUS server type
server-type
{
extended
|
standard
}
Optional
standard
by default
NOTE:
Changing the RADIUS server type will restore the unit for data flows and that for packets that are sent
to the RADIUS server to the defaults.
Setting the status of RADIUS servers
By setting the status of RADIUS servers to blocked or active, you can control which servers the device will
communicate with for authentication, authorization, and accounting or turn to when the current servers
are not available anymore. In practice, you can specify one primary RADIUS server and multiple
secondary RADIUS servers, with the secondary ones as the backup of the primary one. Generally, the
device chooses servers based on these rules:
When the primary server is in the active
state, the device communicates with the primary server. If
the primary server fails, the device changes the state of the primary server to blocked and starts a
quiet timer for the server, and then turns to a secondary server in the active state (a secondary
server configured earlier has a higher priority). If the secondary server is unreachable, the device
changes the server’s status to blocked, starts a quiet timer for the server, and continues to check the
next secondary server in the active state. This search process continues until the device finds an
available secondary server or has checked all secondary servers in the active state. If the quiet timer
of a server expires or an authentication or accounting response is received from the server, the state
of the server changes back to active automatically, but the device does not check the server again. If
no server is found reachable during one search process, the device considers the authentication or
accounting attempt a failure.
Once the accounting process of a user starts, the device keeps sending the user’s real-time
accounting requests and stop-accounting requests to the same accounting server. If you remove the
