H3C SecPath F1020 Configuration Guide

8
MS-CHAP-V2 authentication supports password change only when using RADIUS.
As a best practice, do not set the authentication method for PPP users to none when MS-CHAP-V2
authentication is used.
For local AAA authentication, the username and password of the peer must be configured on the
authenticator. For remote AAA authentication, the username and password of the peer must be
configured on the remote AAA server. The username and password of the peer configured on the
authenticator or remote AAA server must be the same as those configured on the peer.
If authentication name is configured, the username configured for the authenticator on the peer must
be the same as that configured on the authenticator by using the
ppp chap user command.
Configuring MS-CHAP or MS-CHAP-V2 authentication (authenticator name is configured)
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
3. Configure the authenticator to authenticate the peer by using MS-CHAP or MS-CHAP-V2.
ppp authentication-mode { ms-chap | ms-chap-v2 } [ [ call-in ] domain
{ isp-name | default enable isp-name } ]
By default, PPP authentication is disabled.
4. Configure a username for the MS-CHAP or MS-CHAP-V2 authenticator.
ppp chap user username
5. Configure local or remote AAA authentication.
For more information about AAA authentication, see Security Configuration Guide.
Configuring MS-CHAP or MS-CHAP-V2 authentication (authenticator name is not configured)
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
3. Configure the authenticator to authenticate the peer by using MS-CHAP or MS-CHAP-V2.
ppp authentication-mode { ms-chap | ms-chap-v2 } [ [ call-in ] domain
{ isp-name | default enable isp-name } ]
By default, PPP authentication is disabled.
4. Configure local or remote AAA authentication.
For more information about AAA authentication, see Security Configuration Guide.
Configuring the polling feature
About the polling feature
The polling feature checks PPP link state.
On an interface that uses PPP encapsulation, the link layer sends keepalive packets at keepalive
intervals to detect the availability of the peer. If the interface receives no response to keepalive
packets when the keepalive retry limit is reached, it determines that the link fails and reports a link
layer down event.
To set the keepalive retry limit, use the
timer-hold retry command.
The value 0 disables an interface from sending keepalive packets. In this case, the interface can
respond to keepalive packets from the peer.

H3C SecPath F1020 Specifications

General

Brand	H3C
Model	SecPath F1020
Category	Firewall
Language	English