Configuring RADIUS 769
n
■ If both the primary server and the secondary server are in the blocked state, it
is necessary to manually turn the secondary server to the active state so that
the secondary server can perform authentication. If the secondary server is still
in the blocked state, the primary/secondary switchover cannot take place.
■ If one server is in the active state while the other is blocked, the
primary/secondary switchover will not take place even if the active server is not
reachable.
Configuring Attributes
Related to the Data Sent
to the RADIUS Server
Follow these steps to configure the attributes related to the data sent to the
RADIUS server:
n
■ Some earlier RADIUS servers cannot recognize usernames that contain an ISP
domain name, therefore before sending a username including a domain name
to such a RADIUS server, the device must remove the domain name. This
Set the status of the primary
RADIUS
authentication/authorization
server
state primary
authentication { active |
block }
Optional
active for every server
configured with IP address in
the RADIUS scheme
Set the status of the primary
RADIUS accounting server
state primary accounting
{ active | block }
Set the status of the
secondary RADIUS
authentication/authorization
server
state secondary
authentication { active |
block }
Set the status of the
secondary RADIUS accounting
server
state secondary accounting
{ active | block }
To do… Use the command… Remarks
To do… Use the command… Remarks
Enter system view system-view -
Enable the RADIUS trap
function
radius trap
{ accounting-server-down |
authentication-server-dow
n }
Optional
Disabled by default
Create a RADIUS scheme and
enter RADIUS scheme view
radius scheme
radius-scheme-name
Required
Not defined by default
Specify the format of the
username to be sent to a
RADIUS server
user-name-format
{ with-domain |
without-domain }
Optional
By default, the ISP domain
name is included in the
username.
Specify the unit for data flows
or packets to be sent to a
RADIUS server
data-flow-format { data
{ byte | giga-byte |
kilo-byte | mega-byte } |
packet { giga-packet |
kilo-packet | mega-packet |
one-packet }}*
Optional
The defaults are as follows:
byte for data flows, and
one-packet for data packets.
Set the source
IP address of
the device to
send RADIUS
packets
In RADIUS
scheme view
nas-ip ip-address Use either command
By default, the outbound port
serves as the source IP
address to send RADIUS
packets
In system view quit
radius nas-ip ip-address
To Next Page
Loading...
