Configuring RADIUS 765
■ The attribute ip command only applies to authentications that support IP
address passing, such as 802.1x. If you configure the command to
authentications that do not support IP address passing, such as MAC address
authentication, the local authentication will fail.
■ The attribute port command binds a port by its number only, regardless of
the port type.
■ The idle-cut command configured under ISP view applies to lan-access users
only.
Tearing down User
Connections Forcibly
Follow these steps to tear down user connections forcibly:
Configuring RADIUS The RADIUS protocol is configured scheme by scheme. After creating a RADIUS
scheme, you need to configure the IP addresses and UDP ports of the RADIUS
servers for the scheme. The servers include authentication/authorization servers
and accounting servers, or from another point of view, primary servers and
secondary servers. In another words, the attributes of a RADIUS scheme mainly
include IP addresses of primary and secondary servers, shared key, and RADIUS
server type.
Actually, the RADIUS protocol configurations only set the parameters necessary for
the information interaction between a NAS and a RADIUS server. For these
settings to take effect, you must reference the RADIUS scheme containing those
settings in ISP domain view. For information about the commands for referencing
a scheme, refer to “Configuring AAA” on page 758.
Creating a RADIUS
Scheme
Before performing other RADIUS configurations, follow these steps to create a
RADIUS scheme and enter RADIUS scheme view:
n
A RADIUS scheme can be referenced by more than one ISP domain at the same
time.
Specifying the RADIUS
Authentication/Authoriz
ation Servers
Follow these steps to specify the RADIUS authentication/authorization servers:
To do… Use the command… Remarks
Enter system view system-view -
Tear down AAA user
connections forcibly
cut connection { access-type { dot1x |
mac-authentication | portal } | all | domain
isp-name | interface interface-type
interface-number | ip ip-address | mac
mac-address | ucibindex ucib-index | user-name
user-name | vlan vlan-id } [ slot slot-number ]
Required
Applies to only
LAN access user
connections at
present.
To do… Use the command… Remarks
Enter system view system-view -
Create a RADIUS scheme and
enter RADIUS scheme view
radius scheme
radius-scheme-name
Optional
Not defined by default
To do… Use the command… Remarks
Enter system view system-view -
To Next Page
Loading...
