63
response from the server before the maximum number of retries is reached, the device considers the
server as reachable. The device sets the status of the server to
block
or
active
according to the status
detection result, regardless of the current status of the server.
For 802.1X authentication, if the status of every server is
block
, the device will assign the port connected
to an authentication user to the specified 802.1X critical VLAN. For more information about the 802.1X
critical VLAN, see
Security Configuration Guide
.
To ensure that the device can set the server to its actual status, set a longer quiet timer for the secondary
server with the
timer quiet
command. If you set a short quiet timer and configure 802.1X critical VLAN on
a port, the device might frequently change the server status, and the port might frequently join and leave
the critical VLAN.
Related commands:
key
,
radius scheme
, and
state
.
Examples
# Specify the secondary authentication/authorization server for RADIUS scheme
radius1
.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] secondary authentication 10.110.1.2 1812
# Specify two secondary authentication/authorization servers for RADIUS scheme
radius2
, with the
server IP addresses of 10.110.1.1 and 10.110.1.2, and the UDP port number of 1813.
<Sysname> system-view
[Sysname] radius scheme radius2
[Sysname-radius-radius2] secondary authentication 10.110.1.1 1812
[Sysname-radius-radius2] secondary authentication 10.110.1.2 1812
# In RADIUS scheme
radius1
, set the username used for status detection of the secondary
authentication/authorization server to
test
, and set the server status detection interval to 120 minutes.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] secondary authentication 10.110.1.1 probe username test interval
120
security-policy-server
Syntax
security-policy-server
ip-address
undo security-policy-server
{
ip-address
|
all
}
View
RADIUS scheme view
Default level
2: System level
Parameters
ip-address
: Specifies a security policy server by its IP address.
all
: Specifies all security policy servers.
Description
Use the
security-policy-server
command to specify a security policy server for a RADIUS scheme.
