HP E-MSM310, Management And Configuration Manual

Page: 138 / 210

Security
Using an external RADIUS server
6-4
 Retry interval: Specify the number of seconds that the RADIUS server waits before
access and accounting requests time out. If the server does not receive a reply within this
interval, the AP switches between the primary and secondary RADIUS servers, if a
secondary server is defined. A reply that is received after the retry interval expires is
ignored.
Retry interval applies to access and accounting requests that are generated by the
following:
 Manager access to the management tool
 MAC-based authentication of devices.
You can determine the maximum number of retries as follows:
 MAC-based authentication: Number of retries is infinite.
 802.1X authentication: Retries are controlled by the 802.1X client software.
 Authentication method: Select the default authentication method that the AP uses
when exchanging authentication packets with the RADIUS server defined for this profile.
For 802.1X users, the authentication method is always determined by the 802.1X client
software and is not controlled by this setting.
If traffic between the AP and the RADIUS server is not protected by a VPN, it is
recommended that you use either EAP-MD5 or MSCHAP V2 (if supported by your
RADIUS Server). PAP, MSCHAP V1, and CHAP are less secure protocols.
 NAS ID: Specify the identifier for the network access server that you want to use for the
AP. By default the serial number of the AP is used. The AP includes the NAS-ID attribute
in all packets that it sends to the RADIUS server.
 Always try primary server first: Enable this option if you want to force the AP to
contact the primary server first.
Otherwise, the AP sends the first RADIUS access request to the last known RADIUS
server that replied to any previous RADIUS access request. If the request times out, the
next request is sent to the other RADIUS server if defined.
For example, assume that the primary RADIUS server was not reachable and that the
secondary server responded to the last RADIUS access request. When a new
authentication request is received, the AP sends the first RADIUS access request to the
secondary RADIUS server.
If the secondary RADIUS server does not reply, the AP retransmits the RADIUS access
request to the primary RADIUS server. When two servers are configures, the AP always
alternates between the two.
 Use message authenticator: When enabled, causes the RADIUS Message-
Authenticator attribute to be included in all RADIUS access requests sent by the AP.
Note: This option has no effect on IEEE802dot1x authentication requests. These
requests always include the RADIUS Message-Authenticator attribute.