HP 3600 v2 Series Configuration Guide

28
• After receiving an authentication/accounting response from a server, the switch changes the status
of the server identified by the source IP address of the response to active if the current status of the
server is blocked.
The device does not change the status of an unreachable authentication or accounting server if the server
quiet timer is set to 0. Instead, the device keeps the server status as active and sends authentication or
accounting packets to another server in active state, so subsequent authentication or accounting packets
can still be sent to that server. For more information about the server quiet timer, see "Setting timers for
co
ntrolling communication with HWTACACS servers."
By default, the switch sets the status of all RADIUS servers to active. In cases such as a server failure, you
can change the status of the server to blocked to avoid communication with the server.
To set the status of RADIUS servers in a RADIUS scheme:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enter RADIUS scheme
view.
radius scheme radius-scheme-name N/A
3. Set the RADIUS server
status.
• Set the status of the primary RADIUS
authentication/authorization server:
state primary authentication { active | block }
• Set the status of the primary RADIUS
accounting server:
state primary accounting { active | block }
• Set the status of a secondary RADIUS
authentication/authorization server:
state secondary authentication [ ip
ipv4-address | ipv6 ipv6-address ] { active |
block }
• Set the status of a secondary RADIUS
accounting server:
state secondary accounting [ ip ipv4-address
| ipv6 ipv6-address ] { active | block }
Optional.
By default, all servers in
the RADIUS scheme are
in active state.
NOTE:
• The server status set by the state command cannot be saved to the configuration file. After the switch
restarts, the status of each server is restored to active.
• To display the states of the servers, use the display radius scheme command.
Specifying the source IP address for outgoing RADIUS packets
The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS
configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a
RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of
any managed NAS. If yes, the server processes the packet. If not, the server drops the packet.
Usually, the source address of outgoing RADIUS packets can be the IP address of the NAS's any
interface that can communicate with the RADIUS server. In some special scenarios, however, you must
change the source IP address. If the NAS is configured with VRRP for stateful failover, the source IP
address of outgoing RADIUS packets can be the virtual IP address of the VRRP group to which the uplink
belongs.

HP 3600 v2 Series Specifications

General

Brand	HP
Model	3600 v2 Series
Category	Switch
Language	English