25
accounting server, real-time accounting requests and stop-accounting requests of the user cannot be
delivered to the server anymore.
If you remove an authentication or accounting server in use, the communication of the device with
the server will soon time out, and the device will look for a server in the active state from scratch: it
checks the primary server (if any) first and then the secondary servers in the order they are
configured.
When the primary server and secondary servers are all in the blocked
state, the device
communicates with the primary server. If the primary server is available, its state changes to active;
otherwise, its state remains to be blocked.
If one server is in the active state and the others are in the blocked state, the device only tries to
communicate with the server in the active state, even if the server is unavailable.
After receiving an authentication/accounting response from a server, the device changes the state of
the server identified by the source IP address of the response to active if the current state of the
server is blocked.
By default, the device sets the status of all RADIUS servers to active. In some cases, however, you may
need to change the status of a server. For example, if a server fails, you can change the status of the
server to blocked to avoid communication with the server.
Follow these steps to set the status of RADIUS servers:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter RADIUS scheme view
radius scheme
radius-scheme-name
—
Set the status of the primary RADIUS
authentication/authorization server
state
primary
authentication
{
active
|
block
}
Optional
active
for every server
specified in the RADIUS
scheme by default
Set the status of the primary RADIUS
accounting server
state
primary
accounting
{
active
|
block
}
Set the status of the secondary
RADIUS authentication/authorization
server
state
secondary
authentication
[
ip
ipv4-address
|
ipv6
ipv6-address
]
{
active
|
block
}
Set the status of the secondary
RADIUS accounting server
state
secondary accounting
[
ip
ipv4-address
|
ipv6
ipv6-address
]
{
active
|
block
}
NOTE:
The server status set by the
state
command cannot be saved in the configuration file and will be restored to
active every time the server restarts.
To display the states of the servers, use the
display radius scheme
command.
Setting the username format and traffic statistics units
A username is usually in the format of
userid
@
isp-name
, where
isp-name
represents the name of the ISP
domain the user belongs to and is used by the device to determine which users belong to which ISP
domains. However, some earlier RADIUS servers cannot recognize usernames that contain an ISP domain
name. In this case, the device must remove the domain name of each username before sending the
username. You can set the username format on the device for this purpose.
The device periodically sends accounting updates to RADIUS accounting servers to report the traffic
statistics of online users. For normal and accurate traffic statistics, make sure that the unit for data flows
and that for packets on the device are consistent with those on the RADIUS server.
