HP 3600 v2 Series Security Configuration Guide

27
To do… Use the command… Remarks
Set the status of the secondary RADIUS
authentication/authorization server
state secondary authentication [ ip
ipv4-address | ipv6 ipv6-address ]
{ active | block }
Set the status of the secondary RADIUS
accounting server
state secondary accounting [ ip
ipv4-address | ipv6 ipv6-address ]
{ active | block }
NOTE:
• The server status set by the state command cannot be saved to the configuration file. After the switch
restarts, the status of each server is restored to active.
• To display the states of the servers, use the display radius scheme command.
Specifying the source IP address for outgoing RADIUS packets
The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS
configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a
RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of
any managed NAS. If yes, the server processes the packet. If not, the server drops the packet.
Usually, the source address of outgoing RADIUS packets can be the IP address of the NAS’s any
interface that can communicate with the RADIUS server. In some special scenarios, however, you must
change the source IP address. For example, if a Network Address Translation (NAT) device is present
between the NAS and the RADIUS server, the source IP address of outgoing RADIUS packets must be a
public IP address of the NAS. If the NAS is configured with the Virtual Router Redundancy Protocol (VRRP)
for stateful failover, the source IP address of outgoing RADIUS packets can be the virtual IP address of the
VRRP group that the uplink belongs to.
You can specify a source IP address for outgoing RADIUS packets in RADIUS scheme view for a specific
RADIUS scheme, or in system view for all RADIUS schemes whose servers are in a VPN or the public
network. Before sending a RADIUS packet, a NAS selects a source IP address in this order:
1. The source IP address specified for the RADIUS scheme.
2. The source IP address specified in system view for the VPN or public network, depending on where
the RADIUS server resides.
3. The IP address of the outbound interface specified by the route.
Follow these steps to specify a source IP address for all RADIUS schemes in a VPN or the public network:
To do… Use the command… Remarks
Enter system view system-view —
Specify a source IP address for
outgoing RADIUS packets
radius nas-ip { ip-address |
ipv6 ipv6-address }
[ vpn-instance
vpn-instance-name ]
Required
By default, the IP address of the outbound
interface is used as the source IP address.
Follow these steps to specify a source IP address for a specific RADIUS scheme:
To do… Use the command… Remarks
Enter system view system-view —

HP 3600 v2 Series Specifications

General

Brand	HP
Model	3600 v2 Series
Category	Switch
Language	English