HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

36
To configure the IP address of the security policy server for a scheme:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter RADIUS scheme
view.
radius scheme
radius-scheme-name
N/A
3. Specify a security policy
server.
security-policy-server
ip-address
No security policy server is
specified by default.
You can specify up to eight security
policy servers for a RADIUS
scheme.
Configuring interpretation of the RADIUS class attribute as CAR parameters
This task is required when the RADIUS server supports assigning CAR parameters through the
class attribute and the device supports CAR parameters assignment.
According to RFC 2865, a RADIUS server assigns the RADIUS class attribute (attribute 25) to a
RADIUS client. However, the RFC only requires the RADIUS client to send the attribute to the
accounting server on an "as is" basis. It does not require the RADIUS client to interpret the attribute.
When RADIUS servers use the class attribute to deliver the assigned CAR parameters, the device
must interpret the attribute as the CAR parameters to implement user-based traffic monitoring and
controlling.
To configure the device to interpret the RADIUS class attribute as CAR parameters:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter RADIUS scheme view.
radius scheme
radius-scheme-name
N/A
3. Interpret the class attribute as
CAR parameters.
attribute 25 car
By default, RADIUS attribute 25 is not
interpreted as CAR parameters.
Enabling the trap function for RADIUS
With the trap function, the NAS sends a trap message when either of the following events occurs:
• The status of a RADIUS server changes. If the NAS receives no response to an accounting or
authentication request before the specified maximum number of RADIUS request transmission
attempts is exceeded, it considers the server unreachable, sets the status of the server to block
and sends a trap message. If the NAS receives a response from a RADIUS server that it
considers unreachable, the NAS considers that the RADIUS server is reachable again, sets the
status of the server to active, and sends a trap message.
• The ratio of the number of failed transmission attempts to the total number of authentication
request transmission attempts reaches the threshold. This threshold is in the range of 1% to
100%, and the default is 30%. This threshold can only be configured through the MIB.
The failure ratio is typically small. If a trap message is triggered because the failure ratio is higher
than the threshold, troubleshoot the configuration on and the communication between the NAS and
the RADIUS server.
To enable the trap function for RADIUS:
Step Command Remarks
1. Enter system view.
system-view
N/A

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English