31
Step Command Remarks
•
Set the status of a secondary
RADIUS authentication server:
state
secondary
authentication
[ {
ipv4-address
|
ipv6
ipv6-address
} [
port-number
|
vpn-instance vpn-instance-name
]
* ] {
active
|
block
}
•
Set the status of a secondary
RADIUS accounting server:
state
secondary
accounting
[ {
ipv4-address
|
ipv6
ipv6-address
} [
port-number
|
vpn-instance vpn-instance-name
]
* ] {
active
|
block
}
restarts, all servers are
restored to the active state.
Enabling the RADIUS server load sharing feature
By default, the device communicates with RADIUS servers based on the server roles. It first attempts
to communicate with the primary server, and, if the primary server is unavailable, it then searches for
the secondary servers in the order they are configured. The first secondary server in active state is
used for communication. In this process, the workload is always placed on the active server.
Use the RADIUS server load sharing feature to dynamically distribute the workload over multiple
servers regardless of their server roles. The device forwards an AAA request to the most appropriate
server of all active servers in the scheme after it compares the weight values and numbers of
currently served users. Specify a weight value for each RADIUS server based on the AAA capacity of
the server. A larger weight value indicates a higher AAA capacity.
In RADIUS server load sharing, once the device sends a start-accounting request to a server for a
user, it forwards all subsequent accounting requests of the user to the same server. If the accounting
server is unreachable, the device returns an accounting failure message rather than searching for
another active accounting server.
To enable the RADIUS server load sharing feature:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter RADIUS scheme
view.
radius scheme
radius-scheme-name
N/A
3.
Enable the RADIUS
server load sharing
feature.
server-load-sharing enable
By default, this feature is disabled.
Specifying the source IP address for outgoing RADIUS packets
The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS
configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon
receiving a RADIUS packet, a RADIUS server checks whether the source IP address of the packet is
the IP address of a managed NAS.
•
If it is the IP address of a managed NAS, the server processes the packet.
•
If it is not the IP address of a managed NAS, the server drops the packet.
The source address of outgoing RADIUS packets is typically the IP address of an egress interface on
the NAS to communicate with the RADIUS server. However, in some situations, you must change
the source IP address. For example, when VRRP is configured for stateful failover, configure the
virtual IP of the uplink VRRP group as the source address.
You can specify a source IP address for outgoing RADIUS packets in RADIUS scheme view or in
system view.
Содержание FlexFabric 5940 SERIES
Страница 251: ...238 ...
