62
•
simple
key
: Specifies a plaintext shared key. In non-FIPS mode, the key is a string of 1 to 64
characters. In FIPS mode, the key is a string of 8 to 64 characters that must include uppercase letters,
lowercase letters, numbers, and special characters.
•
If neither
cipher
nor
simple
is specified, you set a plaintext shared key string.
probe username
: Enables the device to detect the status of the secondary RADIUS
authentication/authorization server.
username
name
: Specifies the username in the authentication request that is used to detect the status of
the secondary RADIUS authentication/authorization server.
interval
interval
: Specifies the interval between two server status detections. The value ranges from 1 to
3600 and defaults to 60, in minutes.
Description
Use the
secondary authentication
command to specify secondary RADIUS authentication/authorization
servers for a RADIUS scheme.
Use the
undo secondary authentication
command to remove the configuration.
By default, no secondary RADIUS authentication/authorization server is specified.
To configure multiple secondary RADIUS authentication/authorization servers, execute this command
repeatedly. After the configuration, if the primary server fails, the device looks for a secondary server in
active
state (a secondary RADIUS authentication/authorization server configured earlier has a higher
priority) and tries to communicate with it.
A RADIUS scheme supports up to 16 secondary RADIUS authentication/authorization servers.
All authentication/authorization servers, primary or secondary, must use IP addresses of the same IP
version.
The IP addresses of the primary and secondary authentication/authorization servers must be different
from each other. Otherwise, the configuration fails.
The RADIUS service port configured on the device and that of the RADIUS server must be consistent.
The shared keys configured on the device for authentication/authorization packets and that configured
on the RADIUS server must be consistent.
The shared key configured by this command takes precedence over that configured by the
key
authentication
[
cipher
|
simple
]
key
command.
The IP addresses of the authentication/authorization servers and those of the accounting servers must be
of the same IP version.
If you remove a secondary authentication server in use in the authentication process, the communication
with the secondary server will time out, and the device will look for a server in
active
state from scratch:
the new primary server is evaluated at first and then the secondary servers according to the order in
which they are configured.
For security purposes, all shared keys, including shared keys configured in plain text, are saved in
ciphertext.
With the server status detection feature enabled, the device sends an authentication request that carries
the specified username to the secondary server at the specified interval. If the device receives no
response from the server within the time interval specified by the
timer response-timeout
command, the
device sends the authentication request again.
If the maximum number of retries (specified by the
retry
command) is reached and the device still receives
no response from the server, the device considers the server as unreachable. If the device receives a
