28
NOTE:
For an access module, the maximum number of transmission attempts multiplied by the RADIUS server response
timeout period must be less than the client connection timeout time and must not exceed 75 seconds. Otherwise,
stop-accounting messages cannot be buffered, and the primary/secondary server switchover cannot take place.
For example, because the client connection timeout time for voice access is 10 seconds, the product of the two
parameters must be less than 10 seconds; because the client connection timeout time for Telnet access is 30
seconds, the product of the two parameters must be less than 30 seconds.
When configuring the maximum number of RADIUS packet transmission attempts and the RADIUS server
response timeout period, be sure to take the number of secondary servers into account. If the retransmission
process takes too much time, the client connection in the access module may be timed out while the device is
trying to find an available server.
When a number of secondary servers are configured, the client connections of access modules that have a short
client connection timeout period may still be timed out during initial authentication or accounting, even if the
packet transmission attempt limit and server response timeout period are configured with small values. In this
case, the next authentication or accounting attempt may succeed because the device has set the state of the
unreachable servers to blocked and the time for finding a reachable server is shortened.
Be sure to set the server quiet timer properly. Too short a quiet timer may result in frequent authentication or
accounting failures because the device has to repeatedly attempt to communicate with a server that is in the
active state but is unreachable.
For more information about the maximum number of RADIUS packet retransmission attempts, see “
maximum number of RADIUS request transmission attempts
Configuring RADIUS accounting-on
The accounting-on feature enables a device to send accounting-on packets to the RADIUS server after it
reboots, making the server log out users who logged in through the device before the reboot. Without this
feature, users who were online before the reboot cannot re-log in after the reboot, because the RADIUS
server considers they are already online.
If a device sends an accounting-on packet to the RADIUS server but receives no response, it resends the
packet to the server at a particular interval for a specified number of times.
Follow these steps to configure the accounting-on feature for a RADIUS scheme:
To do…
Use the command…
Remarks
Enter system view
system-view
—
Enter RADIUS scheme view
radius scheme
radius-scheme-
name
—
Enable accounting-on and
configure parameters
accounting-on enable
[
interval
seconds
|
send
send-
times
] *
Required
Disabled by default.
The default interval is 3 seconds and the
default number of send-times is 5.
NOTE:
The accounting-on feature requires the cooperation of the iMC network management system.
Specifying a security policy server
The core of the EAD solution is integration and cooperation, and the security policy server is the
management and control center. As a collection of software, the security policy server provides functions
such as user management, security policy management, security status assessment, security cooperation
control, and security event audit.
