HPE FlexFabric 5940 SERIES, Руководство по настройке безопасности

Страница: 69 / 571

56
Step Command Remarks
attribute rejection rule. { { coa-ack | coa-request } * |
{ received | sent } * }
rejection rules exist.
Repeat this command to add
multiple RADIUS attribute rejection
rules.
Setting the maximum number of concurrent login
users
Perform this task to set the maximum number of concurrent users who can log on to the device
through a specific protocol, regardless of their authentication methods. The authentication methods
include no authentication, local authentication, and remote authentication.
To set the maximum number of concurrent login users:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Set the maximum number of
concurrent login users.
•
In non-FIPS mode:
aaa session-limit { ftp | http
| https | ssh | telnet }
max-sessions
•
In FIPS mode:
aaa session-limit { https |
ssh } max-sessions
By default, the maximum number
of concurrent login users is 32 for
each user type.
Configuring a NAS-ID profile
By default, the device sends its device name in the NAS-Identifier attribute of all RADIUS requests.
A NAS-ID profile enables you to send different NAS-Identifier attribute strings in RADIUS requests
from different VLANs. The strings can be organization names, service names, or any user
categorization criteria, depending on the administrative requirements.
For example, map the NAS-ID companyA to all VLANs of company A. The device will send
companyA in the NAS-Identifier attribute for the RADIUS server to identify requests from any
Company A users.
You can apply a NAS-ID profile to portal- or port security-enabled interfaces. For more information,
see "
Configuring portal authentication " and " Configuring port security ."
A NAS-ID can be bound with more than one VLAN, but a VLAN can be bound with only one NAS-ID.
To configure a NAS-ID profile:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Create a NAS-ID profile
and enter NAS-ID profile
view.
aaa nas-id profile profile-name
By default, no NAS-ID profiles
exist.
3. Configure a NAS-ID and
VLAN binding in the
profile.
nas-id
nas-identifier
bind vlan
vlan-id
By default, no NAS-ID and VLAN
bindings exist.