37
NOTE:
A shared key configured on the router must be the same as that configured on the HWTACACS server.
Specifying the VPN to which the servers belongs
After you specify a VPN for an HWTACACS scheme, all the authentication, authorization, and
accounting servers specified for the scheme belong to the VPN. However, if you also specify a VPN
when specifying a server for the scheme, the server belongs to the specific VPN.
To specify a VPN for an HWTACACS scheme:
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enter HWTACACS scheme view.
hwtacacs scheme
hwtacacs-scheme-name
—
3.
Specify a VPN for the HWTACACS scheme.
vpn-instance
vpn-instance-
name
Required
Setting the username format and traffic statistics units
A username is usually in the format of
userid
@
isp-name
, where
isp-name
represents the name of the
user's ISP domain. It is used by the router to determine which users belong to which ISP domains.
However, some HWTACACS servers cannot recognize usernames that contain an ISP domain name. In
this case, the router must remove the domain name of each username before sending the username. Set
the username format on the router for this purpose.
The router periodically sends accounting updates to HWTACACS accounting servers to report the traffic
statistics of online users. For normal and accurate traffic statistics, make sure that the unit for data flows
and that for packets on the router are consistent with those configured on the HWTACACS servers.
To set the username format and the traffic statistics units for an HWTACACS scheme:
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enter HWTACACS scheme view.
hwtacacs scheme
hwtacacs-
scheme-name
—
3.
Set the format of usernames sent
to the HWTACACS servers.
user-name-format
{
keep-
original
|
with-domain
|
without-domain
}
Optional.
By default, the ISP domain name
is included in a username.
4.
Specify the unit for data flows or
packets sent to the HWTACACS
servers.
data-flow-format
{
data
{
byte
|
giga-byte
|
kilo-byte
|
mega- byte
} |
packet
{
giga-
packet
|
kilo-packet
|
mega-
packet
|
one-packet
} }
*
Optional.
By default,
byte
for data flows
and
one-packet
for data
packets.
NOTE:
•
If an HWTACACS server does not support a username with the domain name, configure the router to
remove the domain name before sending the username to the server.
•
For level switching authentication,
user-name-format keep-original
and
user-name-format without-
domain
produce the same results: they ensure that usernames sent to the HWTACACS server carry
no ISP domain name.
