HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

33
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter RADIUS scheme view.
radius scheme
radius-scheme-name N/A
3. Set the RADIUS server
status.
• Set the status of the primary RADIUS
authentication/authorization server:
state primary authentication { active
| block }
• Set the status of the primary RADIUS
accounting server:
state primary accounting { active |
block }
• Set the status of a secondary RADIUS
authentication/authorization server:
state secondary authentication [ ip
ipv4-address | ipv6 ipv6-address ]
{ active | block }
• Set the status of a secondary RADIUS
accounting server:
state secondary accounting [ ip
ipv4-address | ipv6 ipv6-address ]
{ active | block }
Optional.
By default, all servers in
the RADIUS scheme
are in active state.
The server status set by the state command cannot be saved to the configuration file. After the
device restarts, the status of each server is restored to active.
To display the states of the servers, use the display radius scheme command.
Specifying the source IP address for outgoing RADIUS packets
The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS
configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon
receiving a RADIUS packet, a RADIUS server checks whether the source IP address of the packet is
the IP address of any managed NAS. If yes, the server processes the packet. If not, the server drops
the packet.
The source address of outgoing RADIUS packets is typically the IP address of the NAS's any
interface that can communicate with the RADIUS server. In some cases, however, you must change
the source IP address. For example, if a NAT device is present between the NAS and the RADIUS
server, the source IP address of outgoing RADIUS packets must be a public IP address of the NAS.
If the NAS is configured with VRRP for stateful failover, the source IP address of outgoing RADIUS
packets can be the virtual IP address of the uplink VRRP group.
You can specify a source IP address for outgoing RADIUS packets in RADIUS scheme view for a
specific RADIUS scheme, or in system view for all RADIUS schemes whose servers are in a VPN or
the public network. Before sending a RADIUS packet, the NAS selects a source IP address in the
following order:
1. The source IP address specified for the RADIUS scheme.
2. The source IP address specified in system view for the VPN or public network, depending on
where the RADIUS server resides.
3. The IP address of the outbound interface specified by the route.
To specify a source IP address for all RADIUS schemes in a VPN or the public network:
Step Command Remarks
1. Enter system view.
system-view
N/A

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English