HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

41
To specify a VPN for an HWTACACS scheme:
Step Command
1. Enter system view.
system-view
2. Enter HWTACACS scheme view.
hwtacacs scheme
hwtacacs-scheme-name
3. Specify a VPN for the HWTACACS scheme.
vpn-instance
vpn-instance-name
Setting the username format and traffic statistics units
A username is usually in the format userid@isp-name, where isp-name represents the user's ISP
domain name. By default, the ISP domain name is included in a username; however, some
HWTACACS servers do not recognize usernames that contain the ISP domain names. In this case,
you can configure the device to remove the domain name from each username to be sent.
The device periodically sends accounting updates to HWTACACS accounting servers to report the
traffic statistics of online users. For normal and accurate traffic statistics, make sure that the unit for
data flows and that for packets on the device are consistent with those configured on the
HWTACACS servers.
To set the username format and the traffic statistics units for an HWTACACS scheme:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter HWTACACS scheme
view.
hwtacacs scheme
hwtacacs-scheme-name
N/A
3. Set the format of usernames
sent to the HWTACACS
servers.
user-name-format
{
keep-original
|
with-domain
|
without-domain
}
Optional.
By default, the ISP domain name
is included in a username.
4. Specify the unit for data
flows or packets sent to the
HWTACACS servers.
data-flow-format
{
data
{
byte
|
giga-byte
|
kilo-byte
|
mega-byte
} |
packet
{
giga-packet
|
kilo-packet
|
mega-packet
|
one-packet
} }
*
Optional.
The default unit is
byte
for data
flows and
one-packet
for data
packets.
If an HWTACACS server does not support a username that carries the domain name, configure the
device to remove the domain name before sending the username to the server.
For level switching authentication, user-name-format keep-original and user-name-format
without-domain commands all produce the same results: they make sure that usernames sent to
the HWTACACS server carry no ISP domain name.
Specifying the source IP address for outgoing HWTACACS packets
The source IP address of HWTACACS packets that a NAS sends must match the IP address of the
NAS configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address.
Upon receiving an HWTACACS packet, an HWTACACS server checks whether the source IP
address of the packet is the IP address of any managed NAS. If yes, the server processes the packet.
If not, the server drops the packet.
The source address of outgoing HWTACACS packets is typically the IP address of the NAS's any
interface that can communicate with the HWTACACS server. In some cases, however, you must
change the source IP address. For example, if a NAT device is present between the NAS and the
HWTACACS server, the source IP address of outgoing HWTACACS packets must be a public IP
address of the NAS. If the NAS is configured with VRRP for stateful failover, the source IP address of
HWTACACS packets can be the virtual IP address of the uplink VRRP group.

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English