28
Step Command
Remarks
3.
Set the RADIUS server
status.
•
Set the status of the primary RADIUS
authentication/authorization server:
state
primary
authentication
{
active
|
block
}
•
Set the status of the primary RADIUS
accounting server:
state
primary
accounting
{
active
|
block
}
•
Set the status of a secondary RADIUS
authentication/authorization server:
state
secondary
authentication
[
ip
ipv4-address
|
ipv6
ipv6-address
] {
active
|
block
}
•
Set the status of a secondary RADIUS
accounting server:
state
secondary accounting
[
ip
ipv4-address
|
ipv6
ipv6-address
] {
active
|
block
}
Optional.
By default, all servers in
the RADIUS scheme are
in active state.
NOTE:
•
The server status set by the
state
command cannot be saved to the configuration file. After the switch
restarts, the status of each server is restored to active.
•
To display the states of the servers, use the
display radius scheme
command.
Specifying the source IP address for outgoing RADIUS packets
The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS
configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a
RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of
any managed NAS. If yes, the server processes the packet. If not, the server drops the packet.
Usually, the source address of outgoing RADIUS packets can be the IP address of the NAS’s any
interface that can communicate with the RADIUS server. In some special scenarios, however, you must
change the source IP address. If the NAS is configured with VRRP for stateful failover, the source IP
address of outgoing RADIUS packets can be the virtual IP address of the VRRP group to which the uplink
belongs.
You can specify a source IP address for outgoing RADIUS packets in RADIUS scheme view for a specific
RADIUS scheme, or in system view for all RADIUS schemes whose servers are in the same VPN. Before
sending a RADIUS packet, a NAS selects a source IP address in the following order:
•
Source IP address specified for the RADIUS scheme.
•
Source IP address specified in system view for the VPN.
•
IP address of the outbound interface specified by the route.
To specify a source IP address for all RADIUS schemes:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Specify a source IP
address for outgoing
RADIUS packets.
radius nas-ip
{
ip-address
|
ipv6
ipv6-address
}
[
vpn-instance
vpn-instance-name
]
By default, the IP address of the outbound
interface is used as the source IP address.
