HP 5920 Series Configuration Guide

30
• When a number of secondary servers are configured, the client connections of access modules that
have a short client connection timeout period might still be timed out during initial authentication or
accounting, even if the packet transmission attempt limit and server response timeout period are
configured with small values. The next authentication or accounting attempt can succeed because
the device has set the status of the unreachable servers to blocked and the amount of time for
finding a reachable server has been shortened.
• Make sure the server quiet timer is set correctly. A timer that is too short might result in frequent
authentication or accounting failures because the device will continue to attempt to communicate
with an unreachable server that is in active state. A timer that is too long might temporarily block a
reachable server that has recovered from a failure, because the server will remain in blocked state
until the timer expires.
• A short real-time accounting interval helps improve accounting precision but requires many system
resources. When there are 1000 or more users, set the interval to 15 minutes or longer.
To set RADIUS timers:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enter RADIUS scheme view.
radius scheme
radius-scheme-name
N/A
3. Set the RADIUS server
response timeout timer.
timer response-timeout seconds The default setting is 3 seconds.
4. Set the quiet timer for the
servers.
timer quiet minutes The default setting is 5 minutes.
5. Set the real-time accounting
timer.
timer realtime-accounting minutes The default setting is 12 minutes.
Configuring the accounting-on feature
When the accounting-on feature is enabled, the device automatically sends an accounting-on packet to
the RADIUS server after a reboot. Upon receiving the accounting-on packet, the RADIUS server logs out
all online users so they can log in again through the device. Without this feature, users cannot log in
again after the reboot, because the RADIUS server considers them to be online.
You can configure the interval for which the device waits to resend the accounting-on packet and the
maximum number of retries.
To configure the accounting-on feature for a RADIUS scheme:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enter RADIUS scheme view.
radius scheme
radius-scheme-name
N/A
3. Enable accounting-on.
accounting-on enable [ interval
seconds | send send-times ] *
By default, the accounting-on
feature is disabled.
Configuring the IP addresses of the security policy servers
The NAS verifies the validity of received control packets and accepts only control packets from known
servers. To use a security policy server that is independent of the AAA servers, configure the IP address
of the security policy server on the NAS.

HP 5920 Series Specifications

General

Brand	HP
Model	5920 Series
Category	Switch
Language	English