26
•
After receiving an authentication/accounting response from a server, the switch changes the status
of the server identified by the source IP address of the response to
active
if the current status of the
server is
blocked
.
By default, the switch sets the status of all RADIUS servers to
active
. In some cases, however, you may
need to change the status of a server. For example, if a server fails, you can change the status of the
server to
blocked
to avoid communication with the server.
To set the status of RADIUS servers in a RADIUS scheme:
To do…
Use the command…
Remarks
1.
Enter system view.
system-view
—
2.
Enter RADIUS scheme view.
radius scheme
radius-scheme-name
—
3.
Set the status of the primary
RADIUS
authentication/authorization
server.
state
primary
authentication
{
active
|
block
}
Optional.
It is set to
active
for every
server specified in the
RADIUS scheme by default.
4.
Set the status of the primary
RADIUS accounting server.
state
primary
accounting
{
active
|
block
}
5.
Set the status of the secondary
RADIUS
authentication/authorization
server.
state
secondary
authentication
[
ip
ipv4-address
|
ipv6
ipv6-address
]
{
active
|
block
}
6.
Set the status of the secondary
RADIUS accounting server.
state
secondary accounting
[
ip
ipv4-address
|
ipv6
ipv6-address
]
{
active
|
block
}
The server status set by the
state
command cannot be saved to the configuration file. After the switch
restarts, the status of each server is restored to
active
.
To display the states of the servers, use the
display radius scheme
command.
Specifying the source IP address for outgoing RADIUS packets
The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS
configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a
RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of
any managed NAS. If it is, the server processes the packet. If it is not, the server drops the packet.
Usually, the source address of outgoing RADIUS packets can be the IP address of any NAS interface that
can communicate with the RADIUS server. In some special scenarios, however, you must change the
source IP address. For example, if a NAT device is present between the NAS and the RADIUS server,
the source IP address of outgoing RADIUS packets must be a public IP address of the NAS.
You can specify a source IP address for outgoing RADIUS packets in RADIUS scheme view for a specific
RADIUS scheme or in system view for all RADIUS schemes. Before sending a RADIUS packet, a NAS
selects a source IP address in this order:
1.
The source IP address specified for the RADIUS scheme
2.
The source IP address specified in system view
3.
The IP address of the outbound interface specified by the route
Содержание A5830 Series
Страница 207: ...199 Figure 62 SFTP client interface ...
