28
For a type of user, the maximum number of transmission attempts multiplied by the RADIUS server
response timeout period must be less than the client connection timeout time and must not exceed 75
seconds. Otherwise, stop-accounting messages cannot be buffered, and the primary/secondary server
switchover cannot take place. For example, the product of the two parameters must be less than 10
seconds for voice users and less than 30 seconds for Telnet users because the client connection timeout
period for voice users is 10 seconds and that for Telnet users is 30 seconds.
When you configure the maximum number of RADIUS packet transmission attempts and the RADIUS
server response timeout period, be sure to take the number of secondary servers into account. If the
retransmission process takes too much time, the client connection in the access module may be timed out
while the switch is trying to find an available server.
When a number of secondary servers are configured, the client connections of access modules that have
a short client connection timeout period may still be timed out during initial authentication or accounting,
even if the packet transmission attempt limit and server response timeout period are configured with
small values. In this case, the next authentication or accounting attempt may succeed because the switch
has set the state of the unreachable servers to
blocked
, and the time for finding a reachable server is
shortened.
Be sure to set the server quiet timer properly. Too short a quiet timer may result in frequent authentication
or accounting failures because the switch has to repeatedly attempt to communicate with an unreachable
server that is in the
active
state.
For more information about the maximum number of RADIUS packet transmission attempts, see "
the maximum number of RADIUS request transmission attempts
."
Configuring RADIUS accounting-on
The accounting-on feature enables a switch to send accounting-on packets to the RADIUS server after it
reboots, making the server log out users who logged in through the switch before the reboot. Without
this feature, users who were online before the reboot cannot re-log in after the reboot because the
RADIUS server considers them to already be online.
If a switch sends an accounting-on packet to the RADIUS server but receives no response, it resends the
packet to the server at a particular interval for a specified number of times.
To configure the accounting-on feature for a RADIUS scheme:
To do…
Use the command…
Remarks
1.
Enter system view.
system-view
—
2.
Enter RADIUS scheme
view.
radius scheme
radius-scheme-
name
—
3.
Enable accounting-on and
configure parameters.
accounting-on enable
[
interval
seconds
|
send
send-
times
] *
Required.
Disabled by default.
The default interval is 3 seconds, and the
default number of send-times is 5.
The accounting-on feature requires the cooperation of the HP iMC network management system.
Configuring the IP address of the security policy server
The core of the HP EAD solution is integration and cooperation, and the security policy server is the
management and control center. Using a collection of software, the security policy server provides
functions such as user management, security policy management, security status assessment, security
cooperation control, and security event audit.
