26
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Configure a test profile for
detecting the status of
RADIUS authentication
servers.
radius-server test-profile
profile-name
username
name
[
interval
interval
]
By default, no test profiles exist.
You can configure multiple test
profiles in the system.
Creating a RADIUS scheme
Create a RADIUS scheme before performing any other RADIUS configurations. You can configure a
maximum of 16 RADIUS schemes. A RADIUS scheme can be used by multiple ISP domains.
To create a RADIUS scheme:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create a RADIUS scheme
and enter RADIUS scheme
view.
radius scheme
radius-scheme-name
By default, no RADIUS schemes
exist.
Specifying the RADIUS authentication servers
A RADIUS authentication server completes authentication and authorization together, because
authorization information is piggybacked in authentication responses sent to RADIUS clients.
You can specify one primary authentication server and a maximum of 16 secondary authentication
servers for a RADIUS scheme. Secondary servers provide AAA services when the primary server
becomes unavailable. The device searches for an active server in the order the secondary servers
are configured.
If redundancy is not required, specify only the primary server. A RADIUS authentication server can
function as the primary authentication server for one scheme and a secondary authentication server
for another scheme at the same time.
When RADIUS server load sharing is enabled, the device distributes the workload over all servers
without considering the primary and secondary server roles. The device checks the weight value and
number of currently served users for each active server, and then determines the most appropriate
server in performance to receive an authentication request.
To specify RADIUS authentication servers for a RADIUS scheme:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter RADIUS scheme
view.
radius scheme
radius-scheme-name
N/A
3.
Specify RADIUS
authentication servers.
•
Specify the primary RADIUS
authentication server:
primary authentication
{
ipv4-address
|
ipv6
ipv6-address
} [
port-number
|
key
{
cipher
|
simple
}
string
|
test-profile
profile-name
|
vpn-instance
vpn-instance-name
|
weight
weight-value
] *
•
Specify a secondary RADIUS
authentication server:
secondary
authentication
{
ipv4-address
|
ipv6
By default, no authentication
servers are specified.
To support server status detection,
specify an existing test profile for
the RADIUS authentication server.
If the test profile does not exist, the
device cannot detect the server
status.
Two authentication servers in a
scheme, primary or secondary,
cannot have the same
combination of IP address, port
number, and VPN instance.
Содержание FlexFabric 5940 SERIES
Страница 251: ...238 ...
