24
Step Command
Remarks
3.
Specify RADIUS accounting
servers.
•
Specify the primary RADIUS accounting
server:
primary accounting
{
ip-address
|
ipv6
ipv6-address
} [
port-number
|
key
[
cipher
|
simple
]
key
|
vpn-instance
vpn-instance-name
] *
•
Specify a secondary RADIUS accounting
server:
secondary
accounting
{
ip-address
|
ipv6
ipv6-address
} [
port-number
|
key
[
cipher
|
simple
]
key
|
vpn-instance
vpn-instance-name
] *
Configure at least one
command.
No accounting server is
specified by default.
4.
Set the maximum number of
real-time accounting
attempts.
retry realtime-accounting
retry-times
Optional.
The default setting is 5.
5.
Enable buffering of
stop-accounting requests to
which no responses are
received.
stop-accounting-buffer enable
Optional.
Enabled by default.
6.
Set the maximum number of
stop-accounting attempts.
retry stop-accounting
retry-times
Optional.
The default setting is
500.
Specifying the shared keys for secure RADIUS communication
The RADIUS client and RADIUS server use the MD5 algorithm to authenticate packets exchanged
between them and use shared keys for packet authentication and user passwords encryption. They must
use the same key for the same type of communication.
A shared key configured in this task is for all servers of the same type (accounting or authentication) in
the scheme, and has a lower priority than a shared key configured individually for a RADIUS server.
To specify a shared key for secure RADIUS communication:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter RADIUS scheme view.
radius scheme
radius-scheme-name
N/A
3.
Specify a shared key for secure RADIUS
authentication/authorization or
accounting communication.
key
{
accounting
|
authentication
[
cipher
|
simple
] }
key
No shared key is specified by
default.
NOTE:
A shared key configured on the switch must be the same as that configured on the RADIUS server.
Specifying the VPN to which the servers belong
After you specify a VPN for a RADIUS scheme, all the authentication/authorization/accounting servers
specified for the scheme belong to the VPN. However, if you also specify a VPN when specifying a server
for the scheme, the server belongs to the specific VPN.
