22
NOTE:
A RADIUS scheme can be referenced by multiple ISP domains at the same time.
Specifying the RADIUS authentication/authorization servers
Specify one primary authentication/authorization server and up to 16 secondary
authentication/authorization servers for a RADIUS scheme so that the NAS can find a server for user
authentication/authorization when using the scheme. When the primary server is not available, a
secondary server (if any) is used. In a scenario where redundancy is not required, specify only the
primary server.
In RADIUS, user authorization information is piggybacked in authentication responses sent to RADIUS
clients. It is neither allowed nor needed to specify a separate RADIUS authorization server.
To specify RADIUS authentication/authorization servers for a RADIUS scheme:
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Enter RADIUS scheme
view.
radius scheme
radius-scheme-name
—
3.
Specify the primary
RADIUS
authentication/authoriza-
tion server.
primary authentication
{
ip-address
|
ipv6
ipv6-address
} [
port-number
|
key
string
|
vpn-instance
vpn-instance-name
] *
Required.
Configure at least one
command.
No authentication/
authorization server is
specified by default.
4.
Specify the secondary
RADIUS
authentication/authoriza-
tion server.
secondary
authentication
{
ip-address
|
ipv6
ipv6-address
} [
port-number
|
key
string
|
vpn-instance
vpn-instance-name
] *
NOTE:
•
The IP addresses of the primary and secondary authentication/authorization servers for a scheme
must be different from each other. Otherwise, the configuration fails.
•
All servers for authentication/authorization and accountings, primary or secondary, must use IP
addresses of the same IP version.
•
Specify a RADIUS authentication/authorization server as the primary authentication/authorization
server for one scheme and as the secondary authentication/authorization server for another scheme
at the same time.
Specifying the RADIUS accounting servers and the relevant parameters
Specify one primary accounting server and up to 16 secondary accounting servers for a RADIUS
scheme. When the primary server is not available, a secondary server (if any) is used. When
redundancy is not required, specify only the primary server.
By setting the maximum number of real-time accounting attempts for a scheme, you make the router
disconnect users for whom no accounting response is received before the number of accounting attempts
reaches the limit.
When the router receives a connection teardown request from a host or a connection teardown
notification from an administrator, it sends a stop-accounting request to the accounting server. Enable
buffering of non-responded stop-accounting requests to allow the router to buffer and resend a stop-
accounting request until it receives a response or until the number of stop-accounting attempts reaches
the configured limit. In the latter case, the router discards the packet.
