HP 6125XLG R2306-HP 6125XLG Blade Switch Security Configuration Guide - Page 34
Specifying the shared keys for secure RADIUS communication, Specifying a VPN for the scheme
View all HP 6125XLG manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 34 highlights
Step 4. (Optional.) Set the maximum number of real-time accounting attempts. Command retry realtime-accounting retry-times Remarks The default setting is 5. Specifying the shared keys for secure RADIUS communication The RADIUS client and server use the MD5 algorithm and shared keys to generate the Authenticator value for packet authentication and user password encryption. They must use the same key for each type of communication. A key configured in this task is for all servers of the same type (accounting or authentication) in the scheme, and has a lower priority than a key configured individually for a RADIUS server. To specify a shared key for secure RADIUS communication: Step 1. Enter system view. 2. Enter RADIUS scheme view. 3. Specify a shared key for secure RADIUS communication. Command Remarks system-view N/A radius scheme radius-scheme-name N/A key { accounting | authentication } { cipher | simple } string By default, no shared key is specified. The shared key configured on the device must be the same as that configured on the RADIUS server. Specifying a VPN for the scheme The VPN specified for a RADIUS scheme applies to all authentication and accounting servers in that scheme. If a VPN is also configured for an individual RADIUS server, the VPN specified for the RADIUS scheme does not take effect on that server. To specify a VPN for a scheme: Step 1. Enter system view. 2. Enter RADIUS scheme view. 3. Specify a VPN for the RADIUS scheme. Command system-view radius scheme radius-scheme-name vpn-instance vpn-instance-name Remarks N/A N/A By default, a RADIUS scheme belongs to the public network. Setting the username format and traffic statistics units A username is typically in the format userid@isp-name, where isp-name represents the user's ISP domain name. By default, the ISP domain name is included in a username. However, some earlier RADIUS servers do not recognize usernames that contain the ISP domain names. In this case, you can configure the device to remove the domain name of each username to be sent. For correct identification of users, do not configure the device to remove the ISP domain names from usernames for the RADIUS scheme that is referenced by two or more ISP domains. The device reports online user traffic statistics in accounting packets. The traffic measurement units are configurable, but they must be the same as configured on the RADIUS accounting servers. 25