53
Configuring the RADIUS session-control feature
The RADIUS session-control feature can only work with the RADIUS server running on IMC. Enable
this feature for the RADIUS server to dynamically change the user authorization information or
forcibly disconnect users by using session-control packets. This task enables the device to receive
RADIUS session-control packets on UDP port 1812.
To verify the session-control packets sent from a RADIUS server, specify the RADIUS server as a
session-control client to the device. The IP, VPN instance, and shared key settings of the
session-control client must be the same as the corresponding settings of the RADIUS server.
You can specify multiple session-control clients on the device.
The device matches a session-control packet to a session-control client based on IP and VPN
instance settings, and then uses the shared key of the matched client to validate the packet.
The device searches the session-control client settings prior to searching all RADIUS settings for
finding a server whose IP and VPN instance settings match the session-control packet. This process
narrows the search scope for finding the matched RADIUS server.
The session-control client configuration takes effect only when the session-control feature is
enabled.
To configure the RADIUS session-control feature:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable the RADIUS
session-control feature.
radius session-control enable
By default, the RADIUS
session-control feature is
disabled.
3.
Specify a RADIUS
session-control client.
radius session-control client
{
ip
ipv4-address
|
ipv6
ipv6-address
} [
key
{
cipher
|
simple
}
string
|
vpn-instance
vpn-instance-name
] *
By default, no RADIUS
session-control clients are
specified. The device searches all
RADIUS scheme settings to verify
session-control packets.
Configuring the RADIUS DAE server feature
Dynamic Authorization Extensions (DAE) to RADIUS, defined in RFC 5176, can perform the
following operations:
•
Log off online users.
•
Change online user authorization information.
•
Shut down or reboot the online users' access ports.
DAE uses the client/server model.
In a RADIUS network, the RADIUS server typically acts as the DAE client and the NAS acts as the
DAE server.
When the RADIUS DAE server feature is enabled, the NAS performs the following operations:
1.
Listens to the default or specified UDP port to receive DAE requests.
2.
Logs off online users who match the criteria in the requests, changes their authorization
information, or shuts down or reboots their access ports.
3.
Sends DAE responses to the DAE client.
Содержание FlexFabric 5940 SERIES
Страница 251: ...238 ...
