224
Parameter
Description
Timeout:
The timeout, which can be set to a number between 3 and 3600 seconds,
is the maximum time to wait for a reply from a server.
If the server does not reply within this timeframe, it will be considered as dead and
continue with the next enabled server (if any).
RADIUS servers use the UDP protocol. This is unreliable by design. In order to cope
with lost frames, the timeout interval is divided into 3 subintervals of equal length. If
a reply is not received within the subinterval, the request is transmitted again. This
algorithm causes the RADIUS server to be queried up to 3 times before it is
considered to be dead.
Dead Time:
The dead time, which can be set to a number between 0 and 3600
seconds, is the period during which the switch will not send new requests to a
server that has failed to respond to a previous request. This will stop the switch from
continually trying to contact a server that it has already determined as dead.
Setting the dead time to a value greater than zero (0) will enable this feature, but
only if more than one server has been configured.
Authorization and Accounting Configuration
Authorization:
Every CLI commands will be authorized by server when it’s
enabled. The authorization table on the server is able to configure which
CLI command can pass successfully. For example, the server is set to accept
STP command but deny VLAN command. The server will block the command related
to STP which is entered by user, but it will allow the VLAN command to configure
successfully when the user enters a VLAN command.
Fallback to Local Authorization:
Enabled to allow the user who typed the wrong
account or password to login successfully when the user account is on the local
authorization list of the local switch. For example, when the user entered the wrong
account or password, the server will refer to the account information on
the local end of switch. If the account is recorded on the local switch, the user will
be authorized to login with the privilege level set on the local switch.
Accounting:
Enabled to record all the commands the user entered. All the log data
will be recorded on the server when enabled (e.g. login time, log out time, IGMP
setting, VLAN setting, and so on).
RADIUS Authentication Server Configuration
The table has one row for each RADIUS authentication server and a number of
columns, which are:
#:
The RADIUS authentication server number for which the configuration below
applies.
Enabled:
Enables the RADIUS authentication server by checking this box.
IP Address/Hostname:
The IP address or hostname of the RADIUS authentication
server. IP address is expressed in dotted decimal notation.
Port:
The UDP port to use on the RADIUS authentication server. If the port is set to
zero (0), the default port (1812) is used on the RADIUS authentication server.
Secret:
The secret (up to 29 characters long) shared between the RADIUS
authentication server and the switch stack.
