- Table of Contents
-
- 09-Security Command Reference
- 00-Preface
- 01-AAA commands
- 02-Password control commands
- 03-Keychain commands
- 04-Public key management commands
- 05-PKI commands
- 06-IPsec commands
- 07-SSH commands
- 08-SSL commands
- 09-Attack detection and prevention commands
- 10-IP source guard commands
- 11-ARP attack protection commands
- 12-ND attack defense commands
- 13-uRPF commands
- 14-Crypto engine commands
- Related Documents
-
Title | Size | Download |
---|---|---|
01-AAA commands | 648.53 KB |
Contents
authorization-attribute (ISP domain view)
local-server log change-password-prompt
authorization-attribute (local user view/user group view)
password (device management user view)
service-type (local user view)
attribute convert (RADIUS DAS view)
attribute convert (RADIUS scheme view)
attribute reject (RADIUS DAS view)
attribute reject (RADIUS scheme view)
data-flow-format (RADIUS scheme view)
primary accounting (RADIUS scheme view)
primary authentication (RADIUS scheme view)
reset stop-accounting-buffer (for RADIUS)
retry stop-accounting (RADIUS scheme view)
secondary accounting (RADIUS scheme view)
secondary authentication (RADIUS scheme view)
stop-accounting-buffer enable (RADIUS scheme view)
stop-accounting-packet send-force
timer quiet (RADIUS scheme view)
timer realtime-accounting (RADIUS scheme view)
timer response-timeout (RADIUS scheme view)
user-name-format (RADIUS scheme view)
vpn-instance (RADIUS scheme view)
data-flow-format (HWTACACS scheme view)
display stop-accounting-buffer (for HWTACACS)
primary accounting (HWTACACS scheme view)
primary authentication (HWTACACS scheme view)
reset stop-accounting-buffer (for HWTACACS)
retry stop-accounting (HWTACACS scheme view)
secondary accounting (HWTACACS scheme view)
secondary authentication (HWTACACS scheme view)
stop-accounting-buffer enable (HWTACACS scheme view)
timer quiet (HWTACACS scheme view)
timer realtime-accounting (HWTACACS scheme view)
timer response-timeout (HWTACACS scheme view)
user-name-format (HWTACACS scheme view)
AAA commands
General AAA commands
aaa nas-id profile
Use aaa nas-id profile to create a NAS-ID profile and enter its view, or enter the view of an existing NAS-ID profile.
Use undo aaa nas-id profile to delete a NAS-ID profile.
Syntax
aaa nas-id profile profile-name
undo aaa nas-id profile profile-name
Default
No NAS-ID profiles exist.
Views
System view
Predefined user roles
network-admin
Parameters
profile-name: Specifies the NAS-ID profile name, a case-insensitive string of 1 to 31 characters.
Usage guidelines
Configure a NAS-ID profile to maintain NAS-ID and VLAN bindings on the device.
By default, the device sends its device name in the NAS-Identifier attribute of all RADIUS requests.
A NAS-ID profile enables you to send different NAS-Identifier attribute strings in RADIUS requests from different VLANs. The strings can be organization names, service names, or any user categorization criteria, depending on the administrative requirements.
For example, map the NAS-ID companyA to all VLANs of company A. The device will send companyA in the NAS-Identifier attribute for the RADIUS server to identify requests from any Company A users.
You can configure a NAS-ID in NAS-ID profile view or in ISP domain view. The device selects the NAS-ID for the NAS-Identifier attribute in the following order:
1. NAS-ID bound with VLANs in a NAS-ID profile.
2. NAS-ID in an ISP domain.
Examples
# Create a NAS-ID profile named aaa and enter its view.
<Sysname> system-view
[Sysname] aaa nas-id profile aaa
[Sysname-nas-id-prof-aaa]
Related commands
nas-id bind
aaa session-limit
Use aaa session-limit to set the maximum number of concurrent users that can log on to the device through the specified method.
Use undo aaa session-limit to restore the default maximum number of concurrent users for the specified login method.
Syntax
aaa session-limit { ftp | http | https | ssh | telnet } max-sessions
undo aaa session-limit { ftp | http | https | ssh | telnet }
Default
The maximum number of concurrent users is 32 for each user type.
Views
System view
Predefined user roles
network-admin
Parameters
ftp: FTP users.
http: HTTP users.
https: HTTPS users.
ssh: SSH users.
telnet: Telnet users.
max-sessions: Specifies the maximum number of concurrent login users. The value range for FTP, SSH, and Telnet services is 1 to 32, and the value range for HTTP and HTTPS services is 1 to 64.
Usage guidelines
After the maximum number of concurrent login users for a user type exceeds the upper limit, the system denies the subsequent users of this type.
Examples
# Set the maximum number of concurrent FTP users to 4.
<Sysname> system-view
[Sysname] aaa session-limit ftp 4
accounting command
Use accounting command to specify the command line accounting method.
Use undo accounting command to restore the default.
Syntax
accounting command hwtacacs-scheme hwtacacs-scheme-name
undo accounting command
Default
The default accounting methods of the ISP domain are used for command line accounting.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
The command line accounting feature works with the accounting server to record valid commands that have been successfully executed on the device.
· When the command line authorization feature is disabled, the accounting server records all valid commands that have been successfully executed.
· When the command line authorization feature is enabled, the accounting server records only authorized commands that have been successfully executed.
Command line accounting can use only a remote HWTACACS server.
Examples
# In ISP domain test, perform command line accounting based on HWTACACS scheme hwtac.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] accounting command hwtacacs-scheme hwtac
Related commands
accounting default
command accounting (Fundamentals Command Reference)
hwtacacs scheme
accounting default
Use accounting default to specify default accounting methods for an ISP domain.
Use undo accounting default to restore the default.
Syntax
accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ radius-scheme radius-scheme-name | hwtacacs-scheme hwtacacs-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
Default
The default accounting method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
The default accounting method is used for all users that support this method and do not have an accounting method configured.
Local accounting is only used for monitoring and controlling the number of local user connections. It does not provide the statistics function that the accounting feature generally provides.
You can specify one primary default accounting method and multiple backup default accounting methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting default radius-scheme radius-scheme-name local none command specifies the primary default RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when the RADIUS server is invalid. The device does not perform accounting when both of the previous methods are invalid.
When the primary accounting method is local, the following rules apply to the accounting of a user:
· The device uses the backup accounting methods in sequence only if local accounting is invalid for one of the following reasons:
¡ An exception occurs in the local accounting process.
¡ The user account is not configured on the device or the user is not allowed to use the access service.
· The device does not turn to the backup accounting methods if local accounting is invalid because of any other reason. Accounting fails for the user.
Examples
# In ISP domain system, use local accounting as the default accouting method.
<Sysname> system-view
[Sysname] domain name system
[Sysname-isp-system] accounting default local
# In ISP domain test, use RADIUS scheme rd as the primary default accounting method and use local accounting as the backup.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] accounting default radius-scheme rd local
Related commands
hwtacacs scheme
local-user
radius scheme
accounting login
Use accounting login to specify accounting methods for login users.
Use undo accounting login to restore the default.
Syntax
accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ radius-scheme radius-scheme-name | hwtacacs-scheme hwtacacs-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo accounting login
Default
The default accounting methods of the ISP domain are used for login users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
local: Performs local accounting.
none: Does not perform accounting.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
Accounting is not supported for FTP, SFTP, and SCP users.
You can specify one primary accounting method and multiple backup accounting methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting login radius-scheme radius-scheme-name local none command specifies a primary default RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when the RADIUS server is invalid. The device does not perform accounting when both of the previous methods are invalid.
When the primary accounting method is local, the following rules apply to the accounting of a user:
· The device uses the backup accounting methods in sequence only if local accounting is invalid for one of the following reasons:
¡ An exception occurs in the local accounting process.
¡ The user account is not configured on the device.
· The device does not turn to the backup accounting methods if local accounting is invalid because of any other reason. Accounting fails for the user.
Examples
# In ISP domain system, perform local accounting for login users.
<Sysname> system-view
[Sysname] domain name system
[Sysname-isp-system] accounting login local
# In ISP domain test, perform RADIUS accounting for login users based on scheme rd and use local accounting as the backup.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] accounting login radius-scheme rd local
Related commands
accounting default
hwtacacs scheme
local-user
radius scheme
authentication default
Use authentication default to specify default authentication methods for an ISP domain.
Use undo authentication default to restore the default.
Syntax
authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ radius-scheme radius-scheme-name | hwtacacs-scheme hwtacacs-scheme-name ] * [ none ] | local [ ldap-scheme ldap-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo authentication default
Default
The default authentication method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
The default authentication method is used for all users that support this method and do not have an authentication method configured.
You can specify one primary default authentication method and multiple backup default authentication methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication default radius-scheme radius-scheme-name local none command specifies a primary default RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when the RADIUS server is invalid. The device does not perform authentication when both of the previous methods are invalid.
When the primary authentication method is local, the following rules apply to the authentication of a user:
· The device uses the backup authentication methods in sequence only if local authentication is invalid for one of the following reasons:
¡ An exception occurs in the local authentication process.
¡ The user account is not configured on the device or the user is not allowed to use the access service.
· The device does not turn to the backup authentication methods if local authentication is invalid because of any other reason. Authentication fails for the user.
Examples
# In ISP domain system, use local authentication as the default authentication method.
<Sysname> system-view
[Sysname] domain name system
[Sysname-isp-system] authentication default local
# In ISP domain test, use RADIUS scheme rd as the primary default authentication method and use local authentication as the backup.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] authentication default radius-scheme rd local
Related commands
hwtacacs scheme
ldap scheme
local-user
radius scheme
authentication login
Use authentication login to specify authentication methods for login users.
Use undo authentication login to restore the default.
Syntax
authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ radius-scheme radius-scheme-name | hwtacacs-scheme hwtacacs-scheme-name ] * [ none ] | local [ ldap-scheme ldap-scheme-name ] [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo authentication login
Default
The default authentication methods of the ISP domain are used for login users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters.
local: Performs local authentication.
none: Does not perform authentication.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
You can specify one primary authentication method and multiple backup authentication methods.
When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication login radius-scheme radius-scheme-name local none command specifies the default primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when the RADIUS server is invalid. The device does not perform authentication when both of the previous methods are invalid.
When the primary authentication method is local, the following rules apply to the authentication of a user:
· The device uses the backup authentication methods in sequence only if local authentication is invalid for one of the following reasons:
¡ An exception occurs in the local authentication process.
¡ The user account is not configured on the device or the user is not allowed to use the service for accessing the device.
· The device does not turn to the backup authentication methods if local authentication is invalid because of any other reason. Authentication fails for the user.
Examples
# In ISP domain system, perform local authentication for login users.
<Sysname> system-view
[Sysname] domain name system
[Sysname-isp-system] authentication login local
# In ISP domain test, perform RADIUS authentication for login users based on scheme rd and use local authentication as the backup.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] authentication login radius-scheme rd local
Related commands
authentication default
hwtacacs scheme
ldap scheme
local-user
radius scheme
authentication super
Use authentication super to specify methods for user role authentication.
Use undo authentication super to restore the default.
Syntax
authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name } *
undo authentication super
Default
The default authentication methods of the ISP domain are used for user role authentication.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
To enable a user to obtain another user role without reconnecting to the device, you must configure user role authentication. The device supports local and remote methods for user role authentication. For more information about user role authentication, see RBAC configuration in Fundamentals Configuration Guide.
You can specify one authentication method and one backup authentication method to use in case that the previous authentication method is invalid.
Examples
# In ISP domain test, perform user role authentication based on HWTACACS scheme tac.
<Sysname> system-view
[Sysname] super authentication-mode scheme
[Sysname] domain name test
[Sysname-isp-test] authentication super hwtacacs-scheme tac
Related commands
authentication default
hwtacacs scheme
radius scheme
authorization command
Use authorization command to specify command authorization methods.
Use undo authorization command to restore the default.
Syntax
authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] [ none ] | local [ none ] | none }
undo authorization command
Default
The default authorization methods of the ISP domain are used for command authorization.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform authorization. The authorization server does not verify whether the entered commands are permitted by the user role. The commands are executed successfully if the user role has permission to the commands.
Usage guidelines
Command authorization restricts login users to execute only authorized commands by employing an authorization server to verify whether each entered command is permitted.
When local command authorization is configured, the device compares each entered command with the user's configuration on the device. The command is executed only when it is permitted by the user's authorized user roles.
The commands that can be executed are controlled by both the access permission of user roles and command authorization of the authorization server. Access permission only controls whether the authorized user roles have access to the entered commands, but it does not control whether the user roles have obtained authorization to these commands. If a command is permitted by the access permission but denied by command authorization, this command cannot be executed.
You can specify one primary command authorization method and multiple backup command authorization methods.
When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization command hwtacacs-scheme hwtacacs-scheme-name local none command specifies the default HWTACACS authorization method and two backup methods (local authorization and no authorization). The device performs HWTACACS authorization by default and performs local authorization when the HWTACACS server is invalid. The device does not perform command authorization when both of the previous methods are invalid.
Examples
# In ISP domain test, configure the device to perform local command authorization.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] authorization command local
# In ISP domain test, perform command authorization based on HWTACACS scheme hwtac and use local authorization as the backup.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] authorization command hwtacacs-scheme hwtac local
Related commands
command authorization (Fundamentals Command Reference)
hwtacacs scheme
local-user
authorization default
Use authorization default to specify default authorization methods for an ISP domain.
Use undo authorization default to restore the default.
Syntax
authorization default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ radius-scheme radius-scheme-name | hwtacacs-scheme hwtacacs-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo authorization default
Default
The default authorization method of an ISP domain is local.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform authorization. The following default authorization information applies after users pass authentication:
· Non-login users can access the network.
· Login users obtain the level-0 user role. Login users include the Telnet, FTP, SFTP, SCP, and terminal users. Terminal users can access the device through the console port. For more information about the level-0 user role, see RBAC configuration in Fundamentals Configuration Guide.
· The working directory for FTP, SFTP, and SCP login users is the root directory of the NAS. However, the users do not have permission to access the root directory.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
The default authorization method is used for all users that support this method and do not have an authorization method configured.
The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme.
You can specify one primary authorization method and multiple backup authorization methods.
When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization default radius-scheme radius-scheme-name local none command specifies the default RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when the RADIUS server is invalid. The device does not perform authorization when both of the previous methods are invalid.
When the primary authorization method is local, the following rules apply to the authorization of a user:
· The device uses the backup authorization methods in sequence only if local authorization is invalid for one of the following reasons:
¡ An exception occurs in the local authorization process.
¡ The user account is not configured on the device or the user is not allowed to use the access service.
· The device does not turn to the backup authorization methods if local authorization is invalid because of any other reason. Authorization fails for the user.
Examples
# In ISP domain system, use local authorization as the default authorization method.
<Sysname> system-view
[Sysname] domain name system
[Sysname-isp-system] authorization default local
# In ISP domain test, use RADIUS scheme rd as the primary default authorization method and use local authorization as the backup.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] authorization default radius-scheme rd local
Related commands
hwtacacs scheme
local-user
radius scheme
authorization login
Use authorization login to specify authorization methods for login users.
Use undo authorization login to restore the default.
Syntax
authorization login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ radius-scheme radius-scheme-name | hwtacacs-scheme hwtacacs-scheme-name ] * [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }
undo authorization login
Default
The default authorization methods of the ISP domain are used for login users.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
local: Performs local authorization.
none: Does not perform authorization. The following default authorization information applies after users pass authentication:
· Login users obtain the level-0 user role. Login users include the Telnet, FTP, SFTP, SCP, and terminal users. Terminal users can access the device through the console port. For more information about the level-0 user role, see RBAC configuration in Fundamentals Configuration Guide.
· The working directory for FTP, SFTP, and SCP login users is the root directory of the NAS. However, the users do not have permission to access the root directory.
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme.
You can specify one primary authorization method and multiple backup authorization methods.
When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization login radius-scheme radius-scheme-name local none command specifies the default RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when the RADIUS server is invalid. The device does not perform authorization when both of the previous methods are invalid.
When the primary authorization method is local, the following rules apply to the authorization of a user:
· The device uses the backup authorization methods in sequence only if local authorization is invalid for one of the following reasons:
¡ An exception occurs in the local authorization process.
¡ The user account is not configured on the device or the user is not allowed to use the service for accessing the device.
· The device does not turn to the backup authorization methods if local authorization is invalid because of any other reason. Authorization fails for the user.
Examples
# In ISP domain system, perform local authorization for login users.
<Sysname> system-view
[Sysname] domain name system
[Sysname-isp-system] authorization login local
# In ISP domain test, perform RADIUS authorization for login users based on scheme rd and use local authorization as the backup.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] authorization login radius-scheme rd local
Related commands
authorization default
hwtacacs scheme
local-user
radius scheme
authorization-attribute (ISP domain view)
Use authorization-attribute to configure authorization attributes for users in an ISP domain.
Use undo authorization-attribute to restore the default of an authorization attribute.
Syntax
authorization-attribute user-group user-group-name
undo authorization-attribute user-group
Default
No authorization attributes exist.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
user-group user-group-name: Specifies a user group for users. The user-group-name argument is a case-insensitive string of 1 to 32 characters. Authenticated users obtain all attributes of the user group.
Usage guidelines
If the server or NAS does not authorize any attributes to an authenticated user, the device authorizes the attributes in the ISP domain to the user.
Examples
# Specify user group abc as the authorization user group for users in ISP domain test.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] authorization-attribute user-group abc
Related commands
display domain
display domain
Use display domain to display ISP domain configuration.
Syntax
display domain [ name isp-name ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
name isp-name: Specifies an ISP domain by its name, a case-insensitive string of 1 to 255 characters. If you do not specify an ISP domain, this command displays the configuration of all ISP domains.
Usage guidelines
To display load-sharing user groups in an ISP domain and the number of users in each group, you must specify the ISP domain when executing this command.
Examples
# Display the configuration of all ISP domains.
<Sysname> display domain
Total 1 domains
Domain: system
Current state: Active
State configuration: Active
Default authentication scheme: Local
Default authorization scheme: Local
Default accounting scheme: Local
Accounting start failure action: Online
Accounting update failure action: Online
Accounting quota out policy: Offline
Send accounting update:Yes
Service type: HSI
Session time: Exclude idle time
DHCPv6-follow-IPv6CP timeout: 60 seconds
IPv6CP interface ID assignment: Enable
Dual-stack accounting method: Merge
NAS-ID: N/A
Web server URL : Not configured
Web server URL parameters : Not configured
Web server IPv4 address : Not configured
Web server IPv6 address : Not configured
Redirect active time : Not configured
Redirect server IPv4 address: Not configured
Redirect server IPv6 address: Not configured
DHCP access user auto-save : Disabled
Authorization attributes:
Idle cut: Disabled
IGMP access limit: 4
MLD access limit: 4
Access limit: Not configured
Default domain name: system
Table 1 Command output
Field |
Description |
Domain |
ISP domain name. |
Current state |
Current state of the ISP domain: · Blocked. · Active. |
State configuration |
State settings of the ISP domain: · Active—The ISP domain is set to the active state. · Blocked during specific time ranges—The ISP domain is set to the blocked state during the listed time ranges. · Blocked—The ISP domain is set to the blocked state. |
Time ranges |
Time ranges during which the ISP domain is in blocked state. |
Online-user logoff |
Status for the feature of logging off online users when the state of the ISP domain changes to blocked: · Enabled. · Disabled. |
Default authentication scheme |
Default authentication methods. |
Default authorization scheme |
Default authorization methods. |
Default accounting scheme |
Default accounting methods. |
Login authentication scheme |
Authentication methods for login users. |
Login authorization scheme |
Authorization methods for login users. |
Login accounting scheme |
Accounting methods for login users. |
Super authentication scheme |
Authentication methods for obtaining another user role without reconnecting to the device. |
Command authorization scheme |
Command line authorization methods. |
Command accounting scheme |
Command line accounting method. |
RADIUS |
RADIUS scheme. |
HWTACACS |
HWTACACS scheme. |
LDAP |
LDAP scheme. |
Local |
Local scheme. |
None |
No authentication, no authorization, or no accounting. |
Accounting start failure action |
Access control for users that encounter accounting-start failures: · Online—Allows the users to stay online. · Offline—Logs off the users. |
Accounting update failure max-times |
Maximum number of consecutive accounting-update failures allowed by the device for each user in the domain. |
Accounting update failure action |
Access control for users that have failed all their accounting-update attempts: · Online—Allows the users to stay online. · Offline—Logs off the users. |
Accounting quota out policy |
Access control for users that have used up their accounting quotas: · Online—Allows the users to stay online. · Offline—Logs off the users. · Redirect—Redirects the users to the specified URL. |
Redirect URL |
URL to which users are redirected when the users have used up their data quotas. |
Stop accounting |
Whether to send stop-accounting packets for users that have used up their data quotas. |
Send accounting update |
Whether to send accounting-update packets to refresh users' data quotas: · Yes. · No. |
Service type |
Service type of the ISP domain, including HSI, STB, and VoIP. |
Session time |
Online duration sent to the server for users that went offline due to connection failure or malfunction: · Include idle time—The online duration includes the idle timeout period. · Exclude idle time—The online duration does not include the idle timeout period. |
User address type |
Type of IP addresses for users in the ISP domain. This field is not displayed if no user address type is specified for the ISP domain. |
User basic service IP type |
Types of IP addresses that PPPoE and L2TP users rely on to use the basic services: · IPv4. · IPv6. · IPv6-PD. |
DHCPv6-follow-IPv6CP timeout |
This field is not supported in the current software version. IPv6 address wait timer (in seconds) that starts after IPv6CP negotiation for users. |
IPv6CP interface ID assignment |
Whether the device is configured to forcibly assign interface IDs to PPP users during IPv6CP negotiation: · Enable—The device is configured to forcibly assign interface IDs to PPP users during IPv6CP negotiation. It ignores the non-zero and non-conflicted interface IDs carried in Configure-Request packets from PPP users. · Disable—The device is configured not to forcibly assign interface IDs to PPP users during IPv6CP negotiation. It accepts the non-zero and non-conflicted interface IDs carried in Configure-Request packets from PPP users. |
Dual-stack accounting method |
Accounting method for dual-stack users: · Merge—Merges IPv4 data with IPv6 data for accounting. · Separate—Separates IPv4 data from IPv6 data for accounting. |
NAS-ID |
NAS-ID of the device. This field displays N/A if no NAS-ID is set in the ISP domain. |
Web server URL |
URL of the Web server. |
Web server URL parameters |
Parameters added to the URL of the Web server. |
format |
Format of the MAC address added to the URL of the Web server: · XXXXXXXXXXXX (or xxxxxxxxxxxx)—The MAC address is in the one-section format. · XXXX-XXXX-XXXX (or xxxx-xxxx-xxxx)—The MAC address is in the three-section format. · XX-XX-XX-XX-XX-XX (or xx-xx-xx-xx-xx-xx)—The MAC address is in the six-section format. The delimiter in the three-section format and the six-section format is configurable. |
Web server IPv4 address |
IPv4 address of the Web server. |
Web server IPv6 address |
IPv6 address of the Web server. |
Redirect active time |
Active period (in seconds) during which all Web visit requests of a user are redirected to the redirect URL. |
Redirect server IPv4 address |
IPv4 address of the redirect server. |
Redirect server IPv6 address |
IPv6 address of the redirect server. |
DHCP access user auto-save |
Status of the automatic DHCP user backup feature. |
Authorization attributes |
Authorization attributes for users in the ISP domain. |
Idle cut |
Idle cut feature status: · Enabled—The feature is enabled. The device logs off users that do not meet the minimum traffic requirements in an idle timeout period. · Disabled—The feature is disabled. It is the default idle cut state. |
Idle timeout |
Idle timeout period, in minutes. |
Flow |
Minimum traffic that a login user must generate in an idle timeout period, in bytes. |
Traffic direction |
Traffic direction for the idle cut feature: · Both. · Inbound. · Outbound. |
IP pool |
Name of the authorization IPv4 address pool. |
IP pool group |
Name of the authorization IPv4 address pool group. |
Inbound CAR |
Authorization inbound CAR: · CIR—Committed information rate in bps. · PIR—Peak information rate in bps. If no inbound CAR is authorized, this field displays N/A. |
Outbound CAR |
Authorization outbound CAR: · CIR—Committed information rate in bps. · PIR—Peak information rate in bps. If no outbound CAR is authorized, this field displays N/A. |
ACL number |
Authorization ACL for users. |
User group |
Authorization user group for users. |
IPv6 prefix |
Authorization IPv6 address prefix for users. |
IPv6 pool |
Name of the authorization IPv6 address pool for users. |
IPv6 pool group |
Name of the authorization IPv6 address pool group for users. |
IPv6 ND prefix pool |
Name of the authorization prefix pool for users. |
Primary DNS server |
IPv4 address of the authorization primary DNS server for users. |
Secondary DNS server |
IPv4 address of the authorization secondary DNS server for users. |
Primary DNSV6 server |
IPv6 address of the authorization primary DNS server for users. |
Secondary DNSV6 server |
IPv6 address of the authorization secondary DNS server for users. |
URL |
Authorization redirect URL for users. |
Redirect limit |
Maximum number of times the device redirects a user to the redirect URL. If no limit is set, this field displays Unlimited. |
IGMP access limit |
Maximum number of IGMP groups that an IPv4 user is authorized to join concurrently. |
MLD access limit |
Maximum number of MLD groups that an IPv6 user is authorized to join concurrently. |
Inbound user priority |
Authorization user priority for users' upstream packets. |
Outbound user priority |
Authorization user priority for users' downstream packets. |
User session timeout |
Authorization session timeout time for users, in seconds. |
Access limit |
Maximum number of users allowed to access the domain. |
Load-sharing user groups |
Load-sharing user groups and the number of users in each group. |
Table 2 Command output
Field |
Description |
Domain |
ISP domain name. |
Current state |
This field is not supported in the current software version. Current state of the ISP domain: · Blocked. · Active. |
State configuration |
This field is not supported in the current software version. State settings of the ISP domain: · Active—The ISP domain is set to the active state. · Blocked during specific time ranges—The ISP domain is set to the blocked state during the listed time ranges. · Blocked—The ISP domain is set to the blocked state. |
Default authentication scheme |
Default authentication methods. |
Default authorization scheme |
Default authorization methods. |
Default accounting scheme |
Default accounting methods. |
Login authentication scheme |
Authentication methods for login users. |
Login authorization scheme |
Authorization methods for login users. |
Login accounting scheme |
Accounting methods for login users. |
Local |
Local scheme. |
None |
No authentication, no authorization, or no accounting. |
Accounting start failure action |
This field is not supported in the current software version. Access control for users that encounter accounting-start failures: · Online—Allows the users to stay online. · Offline—Logs off the users. |
Accounting update failure action |
This field is not supported in the current software version. Access control for users that have failed all their accounting-update attempts: · Online—Allows the users to stay online. · Offline—Logs off the users. |
Accounting quota out policy |
This field is not supported in the current software version. Access control for users that have used up their accounting quotas: · Online—Allows the users to stay online. · Offline—Logs off the users. · Redirect—Redirects the users to the specified URL. |
Send accounting update |
This field is not supported in the current software version. Whether to send accounting-update packets to refresh users' data quotas: · Yes. · No. |
Service type |
This field is not supported in the current software version. Service type of the ISP domain, including HSI, STB, and VoIP. |
Session time |
This field is not supported in the current software version. Online duration sent to the server for users that went offline due to connection failure or malfunction: · Include idle time—The online duration includes the idle timeout period. · Exclude idle time—The online duration does not include the idle timeout period. |
DHCPv6-follow-IPv6CP timeout |
This field is not supported in the current software version. IPv6 address wait timer (in seconds) that starts after IPv6CP negotiation for PPPoE and L2TP users. |
Dual-stack accounting method |
Accounting method for dual-stack users: · Merge—Merges IPv4 data with IPv6 data for accounting. · Separate—Separates IPv4 data from IPv6 data for accounting. |
NAS-ID |
This field is not supported in the current software version. NAS-ID of the device. This field displays N/A if no NAS-ID is set in the ISP domain. |
Web server URL |
This field is not supported in the current software version. URL of the Web server. |
Web server URL parameters |
This field is not supported in the current software version. Parameters added to the URL of the Web server. |
Web server IPv4 address |
This field is not supported in the current software version. IPv4 address of the Web server. |
Web server IPv6 address |
This field is not supported in the current software version. IPv6 address of the Web server. |
Redirect active time |
This field is not supported in the current software version. Active period (in seconds) during which all Web visit requests of a user are redirected to the redirect URL. |
Redirect server IPv4 address |
This field is not supported in the current software version. IPv4 address of the redirect server. |
Redirect server IPv6 address |
This field is not supported in the current software version. IPv6 address of the redirect server. |
DHCP access user auto-save |
This field is not supported in the current software version. Status of the automatic DHCP user backup feature. |
Authorization attributes |
Authorization attributes for users in the ISP domain. |
Idle cut |
Idle cut feature status: · Enabled—The feature is enabled. The device logs off users that do not meet the minimum traffic requirements in an idle timeout period. · Disabled—The feature is disabled. It is the default idle cut state. |
IGMP access limit |
This field is not supported in the current software version. Maximum number of IGMP groups that an IPv4 user is authorized to join concurrently. |
MLD access limit |
This field is not supported in the current software version. Maximum number of MLD groups that an IPv6 user is authorized to join concurrently. |
Access limit |
Maximum number of users allowed to access the domain. |
domain
Use domain to create an ISP domain and enter its view, or enter the view of an existing ISP domain.
Use undo domain to delete an ISP domain.
Syntax
domain name isp-name
undo domain name isp-name
Default
A system-defined ISP domain exists. The domain name is system.
Views
System view
Predefined user roles
network-admin
Parameters
name isp-name: Specifies the ISP domain name, a case-insensitive string of 1 to 255 characters. The name cannot contain a forward slash (/), backslash (\), vertical bar (|), quotation marks ("), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).
Usage guidelines
All ISP domains are in active state when they are created.
You can modify settings for the system-defined ISP domain system, but you cannot delete this domain.
Examples
# Create an ISP domain named test and enter ISP domain view.
<Sysname> system-view
[Sysname] domain name test
# Enter the view of ISP domain system.
<Sysname> system-view
[Sysname] domain name system
[Sysname-isp-system]
Related commands
display domain
domain default enable
domain if-unknown
state (ISP domain view)
domain default enable
Use domain default enable to specify the default system ISP domain.
Use undo domain default enable to restore the default.
Syntax
domain default enable isp-name
undo domain default enable
Default
The default system ISP domain is the system-defined ISP domain system.
Views
System view
Predefined user roles
network-admin
Parameters
isp-name: Specifies the ISP domain name, a case-insensitive string of 1 to 255 characters. The ISP domain must already exist.
Usage guidelines
The system has only one default system ISP domain.
An ISP domain cannot be deleted when it is the default system ISP domain. Before you use the undo domain command, change the domain to a non-default system ISP domain by using the undo domain default enable command.
Examples
# Create an ISP domain named test, and configure the domain as the default system ISP domain.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] quit
[Sysname] domain default enable test
Related commands
display domain
domain
domain if-unknown
Use domain if-unknown to specify an ISP domain that accommodates users that are assigned to nonexistent domains.
Use undo domain if-unknown to restore the default.
Syntax
domain if-unknown isp-name
undo domain if-unknown
Default
No ISP domain is specified to accommodate users that are assigned to nonexistent domains.
Views
System view
Predefined user roles
network-admin
Parameters
isp-name: Specifies the ISP domain name, a case-insensitive string of 1 to 255 characters. The name cannot contain a forward slash (/), backslash (\), vertical bar (|), quotation marks ("), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).
Usage guidelines
The device chooses an authentication domain for each user in the following order:
1. The authentication domain specified for the access module.
2. The ISP domain in the username.
3. The default system ISP domain.
If the chosen domain does not exist on the device, the device searches for the ISP domain to accommodate users that are assigned to nonexistent domains. If no such ISP domain is configured, user authentication fails.
|
NOTE: Support for the authentication domain configuration depends on the access module. |
Examples
# Specify ISP domain test to accommodate users that are assigned to nonexistent domains.
<Sysname> system-view
[Sysname] domain if-unknown test
Related commands
display domain
local-server log change-password-prompt
Use local-server log change-password-prompt to enable password change prompt logging.
Use undo local-server log change-password-prompt to disable password change prompt logging.
Syntax
local-server log change-password-prompt
undo local-server log change-password-prompt
Default
Password change prompt logging is enabled.
Views
System view
Predefined user roles
network-admin
Usage guidelines
Use this feature to enhance the protection of passwords for Telnet, SSH, HTTP, HTTPS, NETCONF over SSH, and NETCONF over SOAP users and improve the system security.
This feature enables the device to generate logs to prompt users to change their weak passwords at an interval of 24 hours and at the users' login.
A password is a weak password if it does not meet the following requirements:
· Password composition restriction configured by using the password-control composition command.
· Minimum password length restriction set by using the password-control length command.
· It cannot contain the username or the reverse letters of the username.
For a NETCONF over SSH or NETCONF over SOAP user, the device also generates a password change prompt log if any of the following conditions exists:
· The current password of the user is the default password or has expired.
· The user logs in to the device for the first time or uses a new password to log in after global password control is enabled.
The device will no longer generate password change prompt logs for a user when one of the following conditions exists:
· The password change prompt logging feature is disabled.
· The user has changed the password and the new password meets the password control requirements.
· The enabling status of a related password control feature has changed so the current password of the user meets the password control requirements.
· The password composition policy or the minimum password length has changed.
You can use the display password-control command to display password control configuration. For more information about password control commands, see "Password control commands."
Examples
# Enable password change prompt logging.
<Sysname> system-view
[Sysname] local-server log change-password-prompt
Related commands
display password-control
password-control composition
password-control length
nas-id
Use nas-id to set the NAS-ID in an ISP domain.
Use undo nas-id to delete the NAS-ID from an ISP domain.
Syntax
nas-id nas-identifier
undo nas-id
Default
No NAS-ID is set in an ISP domain.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
nas-identifier: Specifies a NAS-ID, a case-sensitive string of 1 to 253 characters.
Usage guidelines
During RADIUS authentication, the device uses a NAS-ID to set the NAS-Identifier attribute of RADIUS packets so that the RADIUS server can identify the access location of users.
Examples
# Set the NAS-ID to test for ISP domain test.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] nas-id test
Related commands
aaa nas-id
aaa nas-id profile
nas-id bind
Use nas-id bind to configure a NAS-ID and VLAN binding.
Use undo nas-id bind to remove a NAS-ID and VLAN binding.
Syntax
nas-id nas-identifier bind vlan vlan-id
undo nas-id nas-identifier bind vlan vlan-id
Default
No NAS-ID and VLAN bindings exist.
Views
NAS-ID profile view
Predefined user roles
network-admin
Parameters
nas-identifier: Specifies a NAS-ID, a case-sensitive string of 1 to 31 characters.
vlan vlan-id: Specifies a VLAN ID in the range of 1 to 4094.
Usage guidelines
You can configure multiple NAS-ID and VLAN bindings in a NAS-ID profile.
Examples
# Bind NAS-ID 222 with VLAN 2 in NAS-ID profile aaa.
<Sysname> system-view
[Sysname] aaa nas-id profile aaa
[Sysname-nas-id-prof-aaa] nas-id 222 bind vlan 2
Related commands
aaa nas-id profile
state (ISP domain view)
Use state to set the status of an ISP domain.
Use undo state to restore the default.
Syntax
state { active | block [ time-range ][ offline ]}
undo state
Default
An ISP domain is in active state.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
active: Places the ISP domain in active state to allow the users in the ISP domain to request network services.
block: Places the ISP domain in blocked state to prevent users in the ISP domain from requesting network services. This keyword takes effect on all types of users except the SSH users that perform publickey authentication.
time-range: Places the ISP domain in blocked state based on time ranges. If you specify the block keyword but do not specify the time-range keyword, the ISP domain is always placed in blocked state.
offline: Logs off online users () in the ISP domain when the state of the ISP domain changes to blocked. If you specify the block keyword but do not specify the offline keyword, the users in the ISP domain stay online when the state of the ISP domain changes to blocked.
Usage guidelines
To block an ISP domain based on time ranges, specify the time-range keyword in this command, and specify time ranges by using the state block time-range name command.
Examples
# Place ISP domain test in blocked state.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] state block
Related commands
display domain
state block time-range name
state block time-range name
Use state block time-range name to specify time ranges during which an ISP domain is placed in blocked state.
Use undo state block time-range name to delete time ranges for placing an ISP domain in blocked state.
Syntax
state block time-range name time-range-name
undo state block time-range { all | name time-range-name }
Default
No time ranges are specified for placing an ISP domain in blocked state.
Views
ISP domain view
Predefined user roles
network-admin
Parameters
time-range-name: Specifies a time range by its name, a case-insensitive string of 1 to 32 characters. The string must begin with a letter and cannot be all.
all: Specifies all time ranges.
Usage guidelines
The specified time ranges take effect only when the device is configured to block an ISP domain based on time ranges. To configure the device to block the ISP domain based on time ranges, use the state block time-range command.
You can repeat this command to specify multiple time ranges.
Examples
# Specify time ranges t1 and t2 for placing ISP domain test in blocked state.
<Sysname> system-view
[Sysname] domain name test
[Sysname-isp-test] state block time-range name t1
[Sysname-isp-test] state block time-range name t2
Related commands
state
time-range (ACL and QoS Command Reference)
Local user commands
access-limit
Use access-limit to set the maximum number of concurrent logins using the local user name.
Use undo access-limit to restore the default.
Syntax
access-limit max-user-number
undo access-limit
Default
The number of concurrent logins using the local user name is not limited.
Views
Local user view
Predefined user roles
network-admin
Parameters
max-user-number: Specifies the maximum number of concurrent logins, in the range of 1 to 1024.
Usage guidelines
This command takes effect only when local accounting is configured for the local user. The command does not apply to FTP, SFTP, or SCP users. The users do not support accounting.
Examples
# Set the maximum number of concurrent logins to 5 for the local user account named abc.
<Sysname> system-view
[Sysname] local-user abc
[Sysname-luser-manage-abc] access-limit 5
Related commands
accounting start-fail offline
display local-user
authorization-attribute (local user view/user group view)
Use authorization-attribute to configure authorization attributes for a local user or user group. After the local user or a local user in the user group passes authentication, the device assigns these attributes to the user.
Use undo authorization-attribute to restore the default of an authorization attribute.
Syntax
authorization-attribute { idle-cut minutes | user-role role-name | work-directory directory-name } *
undo authorization-attribute { idle-cut | user-role role-name | work-directory } *
Default
The working directory for FTP, SFTP, and SCP users is the root directory of the NAS. However, the users do not have permission to access the root directory.
The local users created by a network-admin or level-15 user are assigned the network-operator user role.
Views
Local user view
User group view
Predefined user roles
network-admin
Parameters
idle-cut minutes: Sets an idle timeout period in minutes. The value range for the minutes argument is 1 to 120. An online user is logged out if the user's idle period exceeds the specified idle timeout period.
user-role role-name: Specifies an authorized user role. The role-name argument is a case-sensitive string of 1 to 63 characters. A maximum of 64 user roles can be specified for a user. For user role-related commands, see Fundamentals Command Reference for RBAC commands. This option is available only in local user view, and is not available in user group view.
work-directory directory-name: Specifies the working directory for FTP, SFTP, or SCP users. The directory-name argument is a case-insensitive string of 1 to 255 characters. The directory must already exist.
Usage guidelines
Configure authorization attributes according to the application environments and purposes. Support for authorization attributes depends on the service types of users.
For SSH, Telnet, and terminal users, only the following authorization attributes take effect: idle-cut and user-role.
For HTTP and HTTPS users, only the user-role authorization attribute takes effect.
For FTP users, only the following authorization attributes take effect: user-role and work-directory.
For other types of local users, no authorization attribute takes effect.
Authorization attributes configured for a user group are intended for all local users in the group. You can group local users to improve configuration and management efficiency. An authorization attribute configured in local user view takes precedence over the same attribute configured in user group view.
To make sure FTP, SFTP, and SCP users can access the directory after an active/standby switchover, do not specify slot information for the working directory.
To make sure the user have only the user roles authorized by using this command, use the undo authorization-attribute user-role command to remove the default user role.
The security-audit user role has access to the commands for managing security log files and security log file system. To display all the accessible commands of the security-audit user role, use the display role name security-audit command. For more information about security log management, see Network Management and Monitoring Configuration Guide. For more information about file system management, see Fundamentals Configuration Guide.
You cannot delete a local user if the local user is the only user that has the security-audit user role.
The security-audit user role is mutually exclusive with other user roles.
· When you assign the security-audit user role to a local user, the system requests confirmation for deleting all the other user roles of the user.
· When you assign other user roles to a local user that has the security-audit user role, the system requests confirmation for deleting the security-audit user role for the local user.
Examples
# Configure the authorized VLAN of user group abc as VLAN 3.
<Sysname> system-view
[Sysname] user-group abc
[Sysname-ugroup-abc] authorization-attribute vlan 3
# Assign the security-audit user role to device management user xyz as the authorized user role.
<Sysname> system-view
[Sysname] local-user xyz class manage
[Sysname-luser-manage-xyz] authorization-attribute user-role security-audit
This operation will delete all other roles of the user. Are you sure? [Y/N]:y
Related commands
display local-user
display user-group
display local-user
Use display local-user to display the local user configuration and online user statistics.
Syntax
display local-user [ class manage | idle-cut { disable | enable } | service-type { ftp | http | https | ssh | telnet | terminal } | state { active | block } | user-name user-name class manage | vlan vlan-id ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
class: Specifies the local user type.
manage: Device management user.
idle-cut { disable | enable }: Specifies local users with the idle cut feature disabled or enabled.
service-type: Specifies the local users that use a specific type of service.
ftp: FTP users.
http: HTTP users.
https: HTTPS users.
ssh: SSH users.
telnet: Telnet users.
terminal: Terminal users that log in through console ports.
state { active | block }: Specifies local users in active or blocked state. A local user in active state can access network services, but a local user in blocked state cannot.
user-name user-name: Specifies all local users using the specified username, a string of 1 to 80 characters. The specified username can be a pure username or contain a domain name (in the format of pure-username@domain-name).
· The pure username is a case-sensitive string and must meet the following requirements:
¡ Cannot contain any of the following characters: forward slash (/), backslash (\), vertical bar (|), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).
¡ Cannot be a, al, or all.
· The domain name is a case-insensitive string and cannot contain an at sign (@).
vlan vlan-id: Specifies all local users in a VLAN. The vlan-id argument is in the range of 1 to 4094.
Usage guidelines
If you do not specify any parameters, this command displays information about all local users.
Examples
# Display information about all local users.
<Sysname> display local-user
Total 1 local users matched.
Device management user root:
State: Active
Service type: SSH/Telnet/Terminal
Access limit: Enabled Max access number: 3
Current access number: 1
User group: system
Bind attributes:
Authorization attributes:
Work directory: flash:
User role list: network-admin
Password control configurations:
Password aging: 3 days
Password remaining lifetime: 2 days 12 hours 30 minutes 30 seconds
Password history was last reset: 0 days ago
Table 3 Command output
Field |
Description |
State |
Status of the local user: active or blocked. |
Service type |
Service types that the local user can use. |
Access limit |
Whether the concurrent login limit is enabled. |
Max access number |
Maximum number of concurrent logins using the local user name. |
Current access number |
Current number of concurrent logins using the local user name. |
User group |
Group to which the local user belongs. |
Bind attributes |
This field is not supported in the current software version. Binding attributes of the local user. |
Authorization attributes |
Authorization attributes of the local user. |
Idle timeout |
Idle timeout period of the user, in minutes. |
Work directory |
Directory that the FTP, SFTP, or SCP user can access. |
Password control configurations |
Password control attributes that are configured for the local user. |
Password aging |
Password expiration time. |
Password length |
Minimum number of characters that a password must contain. |
Password composition |
Password composition policy: · Minimum number of character types that a password must contain. · Minimum number of characters from each type in a password. |
Password complexity |
Password complexity checking policy: · Reject a password that contains the username or the reverse of the username. · Reject a password that contains any character repeated consecutively three or more times. |
Maximum login attempts |
Maximum number of consecutive failed login attempts. |
Action for exceeding login attempts |
Action to take on the user that failed to log in after using up all login attempts. |
Password remaining lifetime |
Remaining lifetime of the user's password. |
Password history was last reset |
The most recent time that the password records were cleared. |
display user-group
Use display user-group to display user group configuration.
Syntax
display user-group { all | name group-name }
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
all: Specifies all user groups.
name group-name: Specifies a user group by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Display the configuration of all user groups.
<Sysname> display user-group all
Total 2 user groups matched.
User group: system
Authorization attributes:
Work directory: flash:
User group: jj
Authorization attributes:
Idle timeout: 2 minutes
Work directory: flash:/
Password control configurations:
Password aging: 2 days
Table 4 Command output
Field |
Description |
Authorization attributes |
Authorization attributes of the user group. |
Idle timeout |
Idle timeout period, in minutes. |
Work directory |
Directory that FTP, SFTP, or SCP users in the group can access. |
Password control configurations |
Password control attributes that are configured for the user group. |
Password aging |
Password expiration time. |
Password length |
Minimum number of characters that a password must contain. |
Password composition |
Password composition policy: · Minimum number of character types that a password must contain. · Minimum number of characters from each type in a password. |
Password complexity |
Password complexity checking policy: · Reject a password that contains the username or the reverse of the username. · Reject a password that contains any character repeated consecutively three or more times. |
Maximum login attempts |
Maximum number of consecutive failed login attempts. |
Action for exceeding login attempts |
Action to take on the user that failed to log in after using up all login attempts. |
local-user
Use local-user to add a local user and enter its view, or enter the view of an existing local user.
Use undo local-user to delete local users.
Syntax
local-user user-name [ class manage ]
undo local-user { user-name class manage | all [ service-type { ftp | http | https | ssh | telnet | terminal } | class manage ] }
Default
No local users exist.
Views
System view
Predefined user roles
network-admin
Parameters
user-name: Specifies the username of a local user, a string of 1 to 80 characters. The specified username can be a pure username or contain a domain name (in the format of pure-username@domain-name).
· The pure username is a case-sensitive string and must meet the following requirements:
¡ Cannot contain any of the following characters: forward slash (/), backslash (\), vertical bar (|), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).
¡ Cannot be a, al, or all.
· The domain name is a case-insensitive string and cannot contain an at sign (@).
class: Specifies the local user type. If you do not specify this keyword, the command adds a device management user.
manage: Device management user that can configure and monitor the device after login. Device management users can use FTP, HTTP, HTTPS, Telnet, SSH, and terminal services.
all: Specifies all users.
service-type: Specifies the local users that use a specific type of service.
ftp: FTP users.
http: HTTP users.
https: HTTPS users.
ssh: SSH users.
telnet: Telnet users.
terminal: Terminal users that log in through console ports.
Examples
# Add a device management user named user1 and enter local user view.
<Sysname> system-view
[Sysname] local-user user1 class manage
[Sysname-luser-manage-user1]
Related commands
display local-user
service-type
password (device management user view)
Use password to configure a password for a device management user.
Use undo password to restore the default.
Syntax
password [ { hash | simple } string ]
undo password
Default
A device management user does not have a password and can pass authentication after entering the correct username and passing attribute checks.
Views
Device management user view
Predefined user roles
network-admin
Parameters
hash: Specifies a password encrypted by the hash algorithm.
simple: Specifies a password in plaintext form. For security purposes, the password specified in plaintext form will be stored in encrypted form.
string: Specifies the password string. This argument is case sensitive. The hashed form of the password is a string of 1 to 110 characters. The plaintext form of the password is a string of 1 to 63 characters.
Usage guidelines
If you do not specify any parameters, you enter the interactive mode to set a plaintext password.
A device management user for which no password is specified can pass authentication after entering the correct username and passing attribute checks. To enhance security, configure a password for each device management user.
Examples
# Set the password to 123456TESTplat&! in plaintext form for device management user user1.
<Sysname> system-view
[Sysname] local-user user1 class manage
[Sysname-luser-manage-user1] password simple 123456TESTplat&!
# Configure the password in interactive mode for device management user test.
<Sysname> system-view
[Sysname] local-user test class manage
[Sysname-luser-manage-test] password
Password:
Confirm :
Related commands
display local-user
service-type (local user view)
Use service-type to specify the service types that a local user can use.
Use undo service-type to remove service types configured for a local user.
Syntax
service-type { ftp | { http | https | ssh | telnet | terminal } * }
undo service-type { ftp | { http | https | ssh | telnet | terminal } * }
Default
A local user is not authorized to use any service.
Views
Local user view
Predefined user roles
network-admin
Parameters
ftp: Authorizes the user to use the FTP service. The authorized directory can be modified by using the authorization-attribute work-directory command.
http: Authorizes the user to use the HTTP service.
https: Authorizes the user to use the HTTPS service.
ssh: Authorizes the user to use the SSH service.
telnet: Authorizes the user to use the Telnet service.
terminal: Authorizes the user to use the terminal service and log in from a console, AUX, or async port.
Usage guidelines
You can assign multiple service types to a user.
Examples
# Authorize device management user user1 to use the Telnet and FTP services.
<Sysname> system-view
[Sysname] local-user user1 class manage
[Sysname-luser-manage-user1] service-type telnet
[Sysname-luser-manage-user1] service-type ftp
Related commands
display local-user
state (local user view)
Use state to set the status of a local user.
Use undo state to restore the default.
Syntax
state { active | block }
undo state
Default
A local user is in active state.
Views
Local user view
Predefined user roles
network-admin
Parameters
active: Places the local user in active state to allow the local user to request network services.
block: Places the local user in blocked state to prevent the local user from requesting network services.
Examples
# Place device management user user1 in blocked state.
<Sysname> system-view
[Sysname] local-user user1 class manage
[Sysname-luser-manage-user1] state block
Related commands
display local-user
user-group
Use user-group to create a user group and enter its view, or enter the view of an existing user group.
Use undo user-group to delete a user group.
Syntax
user-group group-name
undo user-group group-name
Default
A system-defined user group exists. The group name is system.
Views
System view
Predefined user roles
network-admin
Parameters
group-name: Specifies the user group name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
A user group consists of a group of local users and has a set of local user attributes. You can configure local user attributes for a user group to implement centralized management of user attributes for the local users in the group.
A user group that has local users cannot be deleted.
You can modify settings for the system-defined user group system, but you cannot delete the user group.
# Create a user group named abc and enter user group view.
<Sysname> system-view
[Sysname] user-group abc
[Sysname-ugroup-abc]
Related commands
display user-group
RADIUS commands
aaa device-id
Use aaa device-id to configure the device ID.
Use undo aaa device-id to restore the default.
Syntax
aaa device-id device-id
undo aaa device-id
Default
The device ID is 0.
Views
System view
Predefined user roles
network-admin
Parameters
device-id: Specifies a device ID in the range of 1 to 255.
Usage guidelines
RADIUS uses the value of the Acct-Session-ID attribute as the accounting ID for a user. The device generates an Acct-Session-ID value for each online user based on the system time, random digits, and device ID.
If you modify the device ID, the new device ID does not take effect on users that have been online during the change.
Examples
# Configure the device ID as 1.
<Sysname> system-view
[Sysname] aaa device-id 1
accounting-on enable
Use accounting-on enable to configure the accounting-on feature.
Use undo accounting-on enable to disable the accounting-on feature.
Syntax
accounting-on enable [ interval interval | send send-times ] *
undo accounting-on enable
Default
The accounting-on feature is disabled.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
interval interval: Specifies the time interval for retransmitting an accounting-on packet in seconds. The value range for the interval argument is 1 to 15, and the default setting is 3.
send send-times: Specifies the maximum number of accounting-on packet transmission attempts. The value range for the send-times argument is 1 to 255, and the default setting is 50.
Usage guidelines
The accounting-on feature enables the device to automatically send an accounting-on packet to the RADIUS server after a device reboot. Upon receiving the accounting-on packet, the RADIUS server logs out all online users so they can log in again through the device.
Execute the save command to ensure that the accounting-on enable command takes effect at the next device reboot. For information about the save command, see Fundamentals Command Reference.
Parameters set by using the accounting-on enable command take effect immediately.
Examples
# Enable the accounting-on feature for RADIUS scheme radius1, and set the retransmission interval to 5 seconds and the transmission attempts to 15.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] accounting-on enable interval 5 send 15
Related commands
display radius scheme
attribute 15 check-mode
Use attribute 15 check-mode to configure the Login-Service attribute check method for SSH, FTP, and terminal users.
Use undo attribute 15 check-mode to restore the default.
Syntax
attribute 15 check-mode { loose | strict }
undo attribute 15 check-mode
Default
The strict check method applies for SSH, FTP, and terminal users.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
loose: Matches the standard Login-Service attribute value 0 for SSH, FTP, and terminal services.
strict: Matches Login-Service attribute values 50, 51, and 52 for SSH, FTP, and terminal services, respectively.
Usage guidelines
Use the loose check method only when the server does not issue Login-Service attribute values 50, 51, and 52 for SSH, FTP, and terminal users.
Examples
# Configure the Login-Service attribute check method as loose for SSH, FTP, and terminal users in RADIUS scheme radius1.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] attribute 15 check-mode loose
Related commands
display radius scheme
attribute 25 car
Use attribute 25 car to configure the device to interpret the RADIUS class attribute (attribute 25) as CAR parameters.
Use undo attribute 25 car to restore the default.
Syntax
attribute 25 car
undo attribute 25 car
Default
The RADIUS class attribute is not interpreted as CAR parameters.
Views
RADIUS scheme view
Predefined user roles
network-admin
Usage guidelines
Configure the device to interpret the RADIUS class attribute if the RADIUS server uses the attribute to deliver CAR parameters for user-based traffic monitoring and control.
The device can interpret the RADIUS class attribute only in the format of string1string2string3string4 as CAR parameters. Each string contains eight characters and each character must be a digit from 0 to 9.
After the device interprets the RADIUS class attribute sent by a RADIUS server as CAR parameters, it carries the interpreted CAR parameters in the subsequent accounting packets sent to that server besides carrying the original class attribute.
Examples
# In RADIUS scheme radius1, configure the device to interpret the RADIUS class attribute as CAR parameters.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] attribute 25 car
Related commands
display radius scheme
attribute 31 mac-format
Use attribute 31 mac-format to configure the MAC address format of RADIUS attribute 31.
Use undo attribute 31 mac-format to restore the default.
Syntax
attribute 31 mac-format section { six | three } separator separator-character { lowercase | uppercase }
undo attribute 31 mac-format
Default
A MAC address is in the format of HH-HH-HH-HH-HH-HH. The MAC address is separated by hyphens (-) into six sections with letters in upper case.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
section: Specifies the number of sections that a MAC address contains.
six: Specifies the six-section format HH-HH-HH-HH-HH-HH.
three: Specifies the three-section format HHHH-HHHH-HHHH.
separator separator-character: Specifies a case-sensitive character that separates the sections.
lowercase: Specifies the letters in a MAC address to be in lower case.
uppercase: Specifies the letters in a MAC address to be in upper case.
Usage guidelines
Configure the MAC address format of RADIUS attribute 31 to meet the requirements of the RADIUS servers.
Examples
# In RADIUS scheme radius1, specify the MAC address format as hh:hh:hh:hh:hh:hh for RADIUS attribute 31.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] attribute 31 mac-format section six separator : lowercase
Related commands
display radius scheme
attribute convert (RADIUS DAS view)
Use attribute convert to configure a RADIUS attribute conversion rule.
Use undo attribute convert to delete RADIUS attribute conversion rules.
Syntax
attribute convert src-attr-name to dest-attr-name { { coa-ack | coa-request } * | { received | sent } * }
undo attribute convert [ src-attr-name ]
Default
No RADIUS attribute conversion rules exist. The system processes RADIUS attributes according to the principles of the standard RADIUS protocol.
Views
RADIUS DAS view
Predefined user roles
network-admin
Parameters
src-attr-name: Specifies the source RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.
dest-attr-name: Specifies the destination RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.
coa-ack: Specifies the CoA acknowledgment packets.
coa-request: Specifies the CoA request packets.
received: Specifies the received DAE packets.
sent: Specifies the sent DAE packets.
Usage guidelines
The device replaces the attribute in packets that match a RADIUS attribute conversion rule with the destination RADIUS attribute in the rule.
The conversion rules take effect only when the RADIUS attribute translation feature is enabled.
When you configure RADIUS attribute conversion rules, follow these restrictions and guidelines:
· The source and destination RADIUS attributes in a rule must use the same data type.
· The source and destination RADIUS attributes in a rule cannot use the same name.
· A source RADIUS attribute can be converted only by one criterion, packet type or direction.
· One source RADIUS attribute cannot be converted to multiple destination attributes.
If you do not specify a source RADIUS attribute, the undo attribute convert command deletes all RADIUS attribute conversion rules.
Examples
# In RADIUS DAS view, configure a RADIUS attribute conversion rule to replace the Hw-Server-String attribute in the received DAE packets with the Connect-Info attribute.
<Sysname> system-view
[Sysname] radius dynamic-author server
[Sysname-radius-da-server] attribute convert Hw-Server-String to Connect-Info received
Related commands
attribute translate
attribute convert (RADIUS scheme view)
Use attribute convert to configure a RADIUS attribute conversion rule.
Use undo attribute convert to delete RADIUS attribute conversion rules.
Syntax
attribute convert src-attr-name to dest-attr-name { { access-accept | access-request | accounting } * | { received | sent } * }
undo attribute convert [ src-attr-name ]
Default
No RADIUS attribute conversion rules exist. The system processes RADIUS attributes according to the principles of the standard RADIUS protocol.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
src-attr-name: Specifies the source RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.
dest-attr-name: Specifies the destination RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.
access-accept: Specifies the RADIUS Access-Accept packets.
access-request: Specifies the RADIUS Access-Request packets.
accounting: Specifies the RADIUS accounting packets.
received: Specifies the received RADIUS packets.
sent: Specifies the sent RADIUS packets.
Usage guidelines
The device replaces the attribute in packets that match a RADIUS attribute conversion rule with the destination RADIUS attribute in the rule.
The conversion rules take effect only when the RADIUS attribute translation feature is enabled.
When you configure RADIUS attribute conversion rules, follow these restrictions and guidelines:
· The source and destination RADIUS attributes in a rule must use the same data type.
· The source and destination RADIUS attributes in a rule cannot use the same name.
· A source RADIUS attribute can be converted only by one criterion, packet type or direction.
· One source RADIUS attribute cannot be converted to multiple destination attributes.
If you do not specify a source RADIUS attribute, the undo attribute convert command deletes all RADIUS attribute conversion rules.
Examples
# In RADIUS scheme radius1, configure a RADIUS attribute conversion rule to replace the Hw-Server-String attribute of received RADIUS packets with the User-Address-Type attribute.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] attribute convert Hw-Server-String to User-Address-Type received
Related commands
attribute translate
display radius scheme
attribute reject (RADIUS DAS view)
Use attribute reject to configure a RADIUS attribute rejection rule.
Use undo attribute reject to delete RADIUS attribute rejection rules.
Syntax
attribute reject attr-name { { coa-ack | coa-request } * | { received | sent } * }
undo attribute reject [ attr-name ]
Default
No RADIUS attribute rejection rules exist.
Views
RADIUS DAS view
Predefined user roles
network-admin
Parameters
attr-name: Specifies a RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.
coa-ack: Specifies the CoA acknowledgment packets.
coa-request: Specifies the CoA request packets.
received: Specifies the received DAE packets.
sent: Specifies the sent DAE packets.
Usage guidelines
Configure RADIUS attribute rejection rules for the following purposes:
· Delete attributes from the RADIUS packets to be sent if the destination RADIUS server does not identify the attributes.
· Ignore unwanted attributes in the RADIUS packets received from a RADIUS server.
The RADIUS attribute rejection rules take effect only when the RADIUS attribute translation feature is enabled.
A RADIUS attribute can be rejected only by one criterion, packet type or direction.
If you do not specify a RADIUS attribute, the undo attribute reject command deletes all RADIUS attribute rejection rules.
Examples
# In RADIUS DAS view, configure a RADIUS attribute rejection rule to delete the Connect-Info attribute from the DAE packets to be sent.
<Sysname> system-view
[Sysname] radius dynamic-author server
[Sysname-radius-da-server] attribute reject Connect-Info sent
Related commands
attribute translate
attribute reject (RADIUS scheme view)
Use attribute reject to configure a RADIUS attribute rejection rule.
Use undo attribute reject to delete RADIUS attribute rejection rules.
Syntax
attribute reject attr-name { { access-accept | access-request | accounting } * | { received | sent } * }
undo attribute reject [ attr-name ]
Default
No RADIUS attribute rejection rules exist.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
attr-name: Specifies a RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.
access-accept: Specifies the RADIUS Access-Accept packets.
access-request: Specifies the RADIUS Access-Request packets.
accounting: Specifies the RADIUS accounting packets.
received: Specifies the received RADIUS packets.
sent: Specifies the sent RADIUS packets.
Usage guidelines
Configure RADIUS attribute rejection rules for the following purposes:
· Delete attributes from the RADIUS packets to be sent if the destination RADIUS server does not identify the attributes.
· Ignore unwanted attributes in the RADIUS packets received from a RADIUS server.
The RADIUS attribute rejection rules take effect only when the RADIUS attribute translation feature is enabled.
A RADIUS attribute can be rejected only by one criterion, packet type or direction.
If you do not specify a RADIUS attribute, the undo attribute reject command deletes all RADIUS attribute rejection rules.
Examples
# In RADIUS scheme radius1, configure a RADIUS attribute rejection rule to delete the Connect-Info attribute from the RADIUS packets to be sent.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] attribute reject Connect-Info sent
Related commands
attribute translate
attribute remanent-volume
Use attribute remanent-volume to set the data measurement unit for the Remanent_Volume attribute.
Use undo attribute remanent-volume to restore the default.
Syntax
attribute remanent-volume unit { byte | giga-byte | kilo-byte | mega-byte }
undo attribute remanent-volume unit
Default
The data measurement unit is kilobyte for the Remanent_Volume attribute.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
byte: Specifies the unit as byte.
giga-byte: Specifies the unit as gigabyte.
kilo-byte: Specifies the unit as kilobyte.
mega-byte: Specifies the unit as megabyte.
Usage guidelines
Make sure the measurement unit is the same as the user data measurement unit on the RADIUS server.
Examples
# In RADIUS scheme radius1, set the data measurement unit to kilobyte for the Remanent_Volume attribute.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] attribute remanent-volume unit kilo-byte
Related commands
display radius scheme
attribute translate
Use attribute translate to enable the RADIUS attribute translation feature.
Use undo attribute translate to disable the RADIUS attribute translation feature.
Syntax
attribute translate
undo attribute translate
Default
The RADIUS attribute translation feature is disabled.
Views
RADIUS DAS view
RADIUS scheme view
Predefined user roles
network-admin
Usage guidelines
To cooperate with RADIUS servers of different vendors, enable the RADIUS attribute translation feature. Configure RADIUS attribute conversion rules and rejection rules to ensure that RADIUS attributes in the packets exchanged between the device and the server are supported by both sides.
Examples
# Enable the RADIUS attribute translation feature for RADIUS scheme radius1.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] attribute translate
Related commands
attribute convert (RADIUS DAS view)
attribute convert (RADIUS scheme view)
attribute reject (RADIUS DAS view)
attribute reject (RADIUS scheme view)
client
Use client to specify a RADIUS DAC.
Use undo client to remove a RADIUS DAC.
Syntax
client { ip ipv4-address | ipv6 ipv6-address } [ key { cipher | simple } string | vpn-instance vpn-instance-name ] *
undo client { ip ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ]
Default
No RADIUS DACs are specified.
Views
RADIUS DAS view
Predefined user roles
network-admin
Parameters
ip ipv4-address: Specifies a DAC by its IPv4 address.
ipv6 ipv6-address: Specifies a DAC by its IPv6 address.
key: Specifies the shared key for secure communication between the RADIUS DAC and DAS. Make sure the shared key is the same as the key configured on the RADIUS DAC. If the RADIUS DAC does not have any shared key, do not specify this option.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the RADIUS DAC belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Usage guidelines
With the RADIUS DAS feature, the device listens to the default or specified UDP port to receive DAE requests from the specified DACs. The device processes the requests and sends DAE responses to the DACs.
The device discards any DAE packets sent from DACs that are not specified for the DAS.
You can execute the client command multiple times to specify multiple DACs for the DAS.
Examples
# Specify the DAC as 10.110.1.2. Set the shared key to 123456 in plaintext form for secure communication between the DAS and DAC.
<Sysname> system-view
[Sysname] radius dynamic-author server
[Sysname-radius-da-server] client ip 10.110.1.2 key simple 123456
Related commands
radius dynamic-author server
port
data-flow-format (RADIUS scheme view)
Use data-flow-format to set the data flow and packet measurement units for traffic statistics.
Use undo data-flow-format to restore the default.
Syntax
data-flow-format { data { byte | giga-byte | kilo-byte | mega-byte } | packet { giga-packet | kilo-packet | mega-packet | one-packet } } *
undo data-flow-format { data | packet }
Default
Traffic is counted in bytes and packets.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
data: Specifies the unit for data flows.
byte: Specifies the unit as byte.
giga-byte: Specifies the unit as gigabyte.
kilo-byte: Specifies the unit as kilobyte.
mega-byte: Specifies the unit as megabyte.
packet: Specifies the unit for data packets.
giga-packet: Specifies the unit as giga-packet.
kilo-packet: Specifies the unit as kilo-packet.
mega-packet: Specifies the unit as mega-packet.
one-packet: Specifies the unit as one-packet.
Usage guidelines
The data flow and packet measurement units for traffic statistics must be the same as configured on the RADIUS accounting servers. Otherwise, accounting results might be incorrect.
Examples
# In RADIUS scheme radius1, set the data flow and packet measurement units for traffic statistics to kilobyte and kilo-packet, respectively.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] data-flow-format data kilo-byte packet kilo-packet
display radius scheme
display radius scheme
Use display radius scheme to display RADIUS scheme configuration.
Syntax
display radius scheme [ radius-scheme-name ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters. If you do not specify a RADIUS scheme, this command displays the configuration of all RADIUS schemes.
Examples
# Display the configuration of all RADIUS schemes.
<Sysname> display radius scheme
Total 1 RADIUS schemes
------------------------------------------------------------------
RADIUS scheme name: radius1
Index : 0
Primary authentication server:
IP : 2.2.2.2 Port: 1812
VPN : vpn1
State: Active
Test profile: 132
Probe username: test
Probe interval: 60 seconds
Weight: 40
Primary accounting server:
IP : 1.1.1.1 Port: 1813
VPN : Not configured
State: Active
Weight: 40
Second authentication server:
IP : 3.3.3.3 Port: 1812
VPN : Not configured
State: Block
Test profile: Not configured
Weight: 40
Second accounting server:
IP : 3.3.3.3 Port: 1813
VPN : Not configured
State: Block (Mandatory)
Weight: 0
Accounting-On function : Enabled
extended function : Disabled
retransmission times : 5
retransmission interval(seconds) : 2
Timeout Interval(seconds) : 3
Retransmission Times : 3
Retransmission Times for Accounting Update : 5
Server Quiet Period(minutes) : 5
Realtime Accounting Interval(seconds) : 22
Stop-accounting packets buffering : Enabled
Retransmission times : 500
NAS IP Address : 1.1.1.1
Source IP address : 1.1.1.1
VPN : Not configured
Username format : with-domain
Data flow unit : Megabyte
Packet unit : One
Attribute 15 check-mode : Strict
Attribute 25 : CAR
Remanent-Volume threshold : 1024
Attribute Remanent-Volume unit : Mega
Server-load-sharing : Disabled
Server-load-sharing mode : Session-based
Attribute 31 MAC format : hh:hh:hh:hh:hh:hh
Stop-accounting-packet send-force : Disabled
RADIUS server version (vendor ID 2011) : 1.0
Authentication response pending limit : Not configured
Accounting response pending limit : Not configured
Username authorization : Not applied
All-server-block action : Attempt the top-priority server
------------------------------------------------------------------
Table 5 Command output
Field |
Description |
Index |
Index number of the RADIUS scheme. |
Primary authentication server |
Information about the primary authentication server. |
Primary accounting server |
Information about the primary accounting server. |
Second authentication server |
Information about the secondary authentication server. |
Second accounting server |
Information about the secondary accounting server. |
IP |
IP address of the server. If no server is configured, this field displays Not configured. |
Port |
Service port number of the server. If no port number is specified, this field displays the default port number. |
VPN |
MPLS L3VPN instance to which the server belongs. If no VPN instance is specified for the server, this field displays Not configured. |
State |
Status of the server: · Active—The server is in active state. · Block—The server is changed to blocked state automatically. · Block (Mandatory)—The server is set to blocked state manually. |
Test profile |
Test profile used for RADIUS server status detection. |
Probe username |
Username used for RADIUS server status detection. |
Probe interval |
Server status detection interval, in seconds. |
Weight |
Weight value of the RADIUS server. |
Accounting-On function |
Whether the accounting-on feature is enabled. |
extended function |
This field is not supported in the current software version. Whether the extended accounting-on feature is enabled. |
retransmission times |
Number of accounting-on packet transmission attempts. |
retransmission interval(seconds) |
Interval at which the device retransmits accounting-on packets, in seconds. |
Timeout Interval(seconds) |
RADIUS server response timeout period, in seconds. |
Retransmission times |
Maximum number of attempts for transmitting a RADIUS packet to a single RADIUS server. |
Retransmission Times for Accounting Update |
Maximum number of accounting attempts. |
Server Quiet Period(minutes) |
Quiet period for the servers, in minutes. |
Realtime Accounting Interval(seconds) |
Interval for sending real-time accounting updates, in seconds. |
Stop-accounting packets buffering |
Whether buffering of nonresponded RADIUS stop-accounting requests is enabled. |
Retransmission times |
Maximum number of transmission attempts for individual RADIUS stop-accounting requests. |
NAS IP Address |
NAS IP address of RADIUS packets. If no NAS IP addresses are specified, this field displays Not configured. |
Source IP address |
Source IP address for outgoing RADIUS packets. If no source IP addresses are specified, this field displays Not configured. |
VPN |
MPLS L3VPN instance to which the RADIUS scheme belongs. If no VPN instance is specified for the server, this field displays Not configured. |
Username format |
Format for the usernames sent to the RADIUS server: · with-domain—Includes the domain name. · without-domain—Excludes the domain name. · keep-original—Forwards the username as the username is entered. |
Data flow unit |
Measurement unit for data flow. |
Packet unit |
Measurement unit for packets. |
Attribute 15 check-mode |
RADIUS Login-Service attribute check method for SSH, FTP, and terminal users: · Strict—Matches Login-Service attribute values 50, 51, and 52 for SSH, FTP, and terminal services, respectively. · Loose—Matches the standard Login-Service attribute value 0 for SSH, FTP, and terminal services. |
Attribute 25 |
RADIUS attribute 25 interpretation status: · Standard—The attribute is not interpreted as CAR parameters. · CAR—The attribute is interpreted as CAR parameters. |
Remanent-Volume threshold |
Available data threshold. The unit for the threshold is the same as the data measurement unit for the RADIUS Remanent_Volume attribute. |
Attribute Remanent-Volume unit |
Data measurement unit for the RADIUS Remanent_Volume attribute. |
Server-load-sharing |
Status of the RADIUS server load sharing feature: · Disabled—The feature is disabled. The device forwards traffic to the server selected based on primary and secondary server roles. · Enabled—The feature is enabled. The device distributes traffic among multiple servers for load sharing. |
Server-load-sharing mode |
RADIUS authentication server load sharing mode: · Session-based. · Packet-based. |
Attribute 31 MAC format |
MAC address format for RADIUS attribute 31. |
Stop-accounting-packet send-force |
Whether the device is enabled to forcibly send stop-accounting packets when users for which no start-accounting packets are sent go offline. |
RADIUS server version (vendor ID 2011) |
This field is not supported in the current software version. Version of the RADIUS servers with a vendor ID of 2011. |
Authentication response pending limit |
This field is not supported in the current software version. Maximum number of pending authentication requests (requests for which no responses are received from the authentication server). If the maximum number of pending authentication requests is not set, this field displays Not configured. |
Accounting response pending limit |
This field is not supported in the current software version. Maximum number of pending accounting requests (requests for which no responses are received from the accounting server). If the maximum number of pending accounting requests is not set, this field displays Not configured. |
Username authorization |
This field is not supported in the current software version. Whether to allow the device to use the server-assigned usernames for AAA processes subsequent to authentication: · Applied—The device uses the server-assigned usernames for AAA processes subsequent to authentication. · Not applied—The device uses the usernames used in authentication for AAA processes subsequent to authentication. |
All-server-block action |
This field is not supported in the current software version. Action to take for AAA requests when all servers in the scheme are blocked: · Attempt the top-priority server. · Skip all servers in the scheme. |
display radius statistics
Use display radius statistics to display RADIUS packet statistics.
Syntax
display radius statistics [ server { ip ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] [ port port-number ] { accounting | authentication } ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
server: Specifies a RADIUS server.
ip ipv4-address: Specifies the IPv4 address of the RADIUS server.
ipv6 ipv6-address: Specifies the IPv6 address of the RADIUS server.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the RADIUS server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
port port-number: Specifies the service port number of the RADIUS server. The value range for the UDP port number is 1 to 65535. The default authentication port number is 1812 and the default accounting port number is 1813.
accounting: Specifies the RADIUS accounting packet statistics.
authentication: Specifies the RADIUS authentication packet statistics.
Usage guidelines
Use this command to display statistics about RADIUS packets exchanged between the device and RADIUS servers, including authentication packets, accounting packets, DAE packets, and session-control packets.
If you do not specify any parameters, this command displays statistics about all types of RADIUS packets exchanged between the device and all RADIUS servers. If you specify a RADIUS server, this command displays statistics about RADIUS authentication or accounting packets exchanged between the device and the specified RADIUS server.
Examples
# Display RADIUS packet statistics for all RADIUS servers.
<Sysname> display radius statistics
Authentication packets:
Requests : 8 Retransmissions : 0
Pending requests : 0 Packet timeouts : 0
Request failures : 0 Challenge packets : 0
Packets without responses : 0 Packets with responses : 0
Accept responses : 8 Reject responses : 0
Unknown-type responses : 0 Malformed responses : 0
Bad authenticators : 0 Dropped responses : 0
Accounting packets:
Requests : 16 Retransmissions : 0
Start requests : 8 Realtime requests : 0
Stop requests : 8 Pending requests : 0
Packet timeouts : 0 Request failures : 0
Packets without responses : 0 Packets with responses : 0
Unknown-type responses : 0 Malformed responses : 0
Bad authenticators : 0 Dropped responses : 0
DAE packets:
DM:
Requests : 0 Request retransmissions: 0
ACKs : 0 NAKs : 0
Timeouts : 0 Malformed requests : 0
Bad authenticators : 0 Dropped requests : 0
CoA:
Requests : 0 Request retransmissions: 0
ACKs : 0 NAKs : 0
Timeouts : 0 Malformed requests : 0
Bad authenticators : 0 Dropped requests : 0
Unknown-type requests : 0
Session-control packets:
Terminate:
Requests : 0 Successes : 0
Failures : 0 Timeouts : 0
Set-policy:
Requests : 0 Successes : 0
Failures : 0 Timeouts : 0
Unknown-type requests : 0 Malformed requests : 0
Bad authenticators : 0 Dropped requests : 0
Authentication servers: 1
IP: 1.1.1.1 Port: 1812
VPN:
Authentication packets:
Requests : 8 Retransmissions : 0
Pending requests : 0 Packet timeouts : 0
Request failures : 0 Challenge packets : 0
Accept responses : 8 Reject responses : 0
Unknown-type responses : 0 Malformed responses : 0
Bad authenticators : 0 Dropped responses : 0
Accounting servers: 1
IP: 1.1.1.1 Port: 1813
VPN:
Accounting packets:
Requests : 16 Retransmissions : 0
Start requests : 8 Realtime requests : 0
Stop requests : 8 Pending requests : 0
Packet timeouts : 0 Request failures : 0
Unknown-type responses : 0 Malformed responses : 0
Bad authenticators : 0 Dropped responses : 0
# Display RADIUS authentication packet statistics for the RADIUS server at 1.1.1.1 with authentication port 1812.
<Sysname> display radius statistics server ip 1.1.1.1 port 1812 authentication
Requests : 8 Retransmissions : 0
Pending requests : 0 Packet timeouts : 0
Request failures : 0 Challenge packets : 0
Accept responses : 8 Reject responses : 0
Unknown-type responses : 0 Malformed responses : 0
Bad authenticators : 0 Dropped responses : 0
Table 6 Command output
Field |
Description |
Authentication packets |
Statistics of authentication packets. |
Accounting packets |
Statistics of accounting packets. |
Requests |
Number of authentication or accounting request packets. The statistics in this field does not include retransmissions. If the statistics of the pending requests increases, the statistics in this field also increases. |
Retransmissions |
Number of times that authentication or accounting request packets were retransmitted. The statistics of this field is not included in the statistics of the Requests field. |
Start requests |
Number of start-accounting request packets. |
Realtime requests |
Number of real-time accounting request packets. |
Stop requests |
Number of stop-accounting request packets. |
Pending requests |
Number of authentication or accounting request packets waiting for responses. The packets have not timed out. |
Packet timeouts |
Number of authentication or accounting request packets that have timed out. |
Request failures |
Number of authentication or accounting request packets that the device failed to send. |
Challenge packets |
Number of authentication challenge packets. |
Packets without responses |
Number of authentication or accounting request packets for which no responses were received. The statistics in this field increases by 1 only after all servers fail to respond to an authentication or accounting request. If this field displays a hyphen (-) for a type of RADIUS packets, the device does not count statistics for that type of RADIUS packets. |
Packets with responses |
Number of authentication or accounting packets for which responses were received. If this field displays a hyphen (-) for a type of RADIUS packets, the device does not count statistics for that type of RADIUS packets. |
Accept responses |
Number of Access-Accept packets. |
Reject responses |
Number of Access-Reject packets. |
Unknown-type responses |
Number of unknown-type authentication or accounting response packets. |
Malformed responses |
Number of authentication or accounting response packets whose length is invalid. |
Bad authenticators |
Number of authentication or accounting response packets whose shared secret is incorrect. |
Dropped responses |
Number of authentication or accounting response packets dropped by any reason other than Unknown-type, Malformed, and Bad authenticators. |
DAE packets |
Statistics of DAE packets. |
DM |
Statistics of DM packets. |
CoA |
Statistics of CoA packets. |
Requests |
Number of DAE request packets. The statistics in this field does not include retransmissions. |
Request retransmissions |
Number of times that DAE request packets were retransmitted. |
ACKs |
Number of DAE ACKs. |
NAKs |
Number of DAE NAKs. |
Session-control packets |
Statistics of session-control packets. |
Terminate |
Number of packets for logging out users forcibly. |
Set-policy |
Number of packets for updating user authorization information. |
Requests |
Number of session-control request packets. |
Successes |
Number of session-control request packets that have been accepted and processed. |
Failures |
Number of session-control request packets that have been denied. |
Timeouts |
Number of DAE or session-control request packets that have timed out. |
Unknown-type requests |
Number of unknown-type DAE or session-control request packets. |
Malformed requests |
Number of DAE or session-control request packets whose length is invalid. |
Bad authenticators |
Number of DAE or session-control request packets whose shared secret is incorrect. |
Dropped requests |
Number of dropped DAE or session-control request packets. |
Authentication servers |
Number of authentication servers. |
Accounting servers |
Number of accounting servers. |
IP |
IP address of the server. |
Port |
Service port number of the server. |
VPN |
MPLS L3VPN instance to which the server belongs. If the server belongs to the public network, this field does not display anything. |
Authentication packets |
Statistics of authentication packets. |
Accounting packets |
Statistics of accounting packets. |
Related commands
reset radius statistics
key (RADIUS scheme view)
Use key to set the shared key for secure RADIUS authentication or accounting communication.
Use undo key to delete the shared key for secure RADIUS authentication or accounting communication.
Syntax
key { accounting | authentication } { cipher | simple } string
undo key { accounting | authentication }
Default
No shared key is configured for secure RADIUS authentication or accounting communication.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
accounting: Specifies the shared key for secure RADIUS accounting communication.
authentication: Specifies the shared key for secure RADIUS authentication communication.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters.
Usage guidelines
The shared keys configured by using this command apply to all servers in the scheme. Make sure the settings match the shared keys configured on the RADIUS servers.
The shared keys specified for specific RADIUS servers take precedence over the shared key specified with this command.
Examples
# In RADIUS scheme radius1, set the shared key to ok in plaintext form for secure accounting communication.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] key accounting simple ok
Related commands
display radius scheme
nas-ip (RADIUS scheme view)
Use nas-ip to specify a NAS IP address for RADIUS packets.
Use undo nas-ip to remove the NAS IP address of the specified type for RADIUS packets.
Syntax
nas-ip { ipv4-address | ipv6 ipv6-address }
undo nas-ip [ ipv6 ]
Default
The NAS IP address of a RADIUS packet is that specified by using the radius nas-ip command in system view.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies an IPv4 address. The IP address cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address.
ipv6 ipv6-address: Specifies an IPv6 address, which must be a unicast address and cannot be a loopback address or a link-local address.
Usage guidelines
Use this command to specify a NAS IP address for the NAS to carry in the NAS-IP-Address or NAS-IPv6-Address attribute in outgoing RADIUS packets. The NAS IP address must be unique for a RADIUS server to identify the NAS.
The NAS can also use the NAS IP address to match incoming RADIUS packets. For example, if the NAS receives a DAE request that contains a NAS IP address, it compares the NAS IP address in the request with the local NAS IP address. The NAS can process this request only when its NAS IP address is the same as the NAS IP address in the request.
You can specify the NAS IP address in interface view, RADIUS scheme view, and system view.
· The NAS IP address specified by using the aaa nas-ip command in interface view applies only to users that access the network through the interface.
· The NAS IP address specified by using the nas-ip command in RADIUS scheme view applies only to the RADIUS scheme.
· The NAS IP address specified by using the radius nas-ip command in system view applies to all RADIUS schemes.
The priority order is as follows:
1. The NAS IP address specified in interface view.
2. The NAS IP address specified in RADIUS scheme view.
3. The NAS IP address specified in system view.
A RADIUS scheme can have only one NAS IPv4 address and one NAS IPv6 address for RADIUS packets.
If you do not specify the ipv6 keyword for the undo nas-ip command, the command removes the configured NAS IPv4 address for RADIUS packets.
Examples
# In RADIUS scheme radius1, specify IP address 10.1.1.1 as the NAS IPv4 address of RADIUS packets.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] nas-ip 10.1.1.1
Related commands
aaa nas-ip
display radius scheme
radius nas-ip
port
Use port to specify the RADIUS DAS port.
Use undo port to restore the default.
Syntax
port port-number
undo port
Default
The RADIUS DAS port number is 3799.
Views
RADIUS DAS view
Predefined user roles
network-admin
Parameters
port-number: Specifies a UDP port number in the range of 1 to 65535.
Usage guidelines
The destination port in DAE packets on the DAC must be the same as the RADIUS DAS port on the DAS.
When the device acts as both the DAS and the DAE proxy, make sure different UDP port numbers are used by the DAS and the DAE proxy to listen for DAE requests from DACs. This restriction ensures that DAE requests from DACs are correctly received and processed by the DAS or the DAE proxy. For more information about the DAE proxy, see "Configuring DAE proxy."
Examples
# Enable the RADIUS DAS to listen to UDP port 3790 for DAE requests.
<Sysname> system-view
[Sysname] radius dynamic-author server
[Sysname-radius-da-server] port 3790
Related commands
client
radius dynamic-author server
primary accounting (RADIUS scheme view)
Use primary accounting to specify the primary RADIUS accounting server.
Use undo primary accounting to restore the default.
Syntax
primary accounting { ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | vpn-instance vpn-instance-name | weight weight-value ] *
undo primary accounting
Default
The primary RADIUS accounting server is not specified.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies the IPv4 address of the primary RADIUS accounting server.
ipv6 ipv6-address: Specifies the IPv6 address of the primary RADIUS accounting server.
port-number: Specifies the service port number of the primary RADIUS accounting server. The value range for the UDP port number is 1 to 65535. The default setting is 1813.
key: Specifies the shared key for secure communication with the primary RADIUS accounting server.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the primary RADIUS accounting server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
weight weight-value: Specifies a weight value for the RADIUS server. The value range for the weight-value argument is 0 to 100, and the default value is 0. The value 0 indicates that the RADIUS server will not be used for load sharing. This option takes effect only when the RADIUS server load sharing feature is enabled for the RADIUS scheme. A larger weight value represents a higher capacity to process accounting requests.
Usage guidelines
Make sure the port number and shared key settings of the primary RADIUS accounting server are the same as those configured on the server.
Two accounting servers specified for a scheme, primary or secondary, cannot have identical IP address, VPN instance, and port number settings.
The shared key configured by using this command takes precedence over the shared key configured with the key accounting command.
If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the RADIUS scheme.
If you use the primary accounting command to modify or delete the primary accounting server to which the device is sending a start-accounting request, communication with the primary server times out.
· When the RADIUS server load sharing feature is disabled, the device tries to communicate with an active server that has the highest priority for accounting.
· When the RADIUS server load sharing feature is enabled, the device returns an accounting failure message rather than searching for another active accounting server.
If you remove an actively used accounting server, the device no longer sends users' real-time accounting requests and stop-accounting requests. It does not buffer the stop-accounting requests. The device can generate incorrect accounting results.
Examples
# In RADIUS scheme radius1, specify the primary accounting server with IP address 10.110.1.2, UDP port number 1813, and plaintext shared key 123456TESTacct&!.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] primary accounting 10.110.1.2 1813 key simple 123456TESTacct&!
Related commands
display radius scheme
key (RADIUS scheme view)
secondary accounting (RADIUS scheme view)
server-load-sharing enable
vpn-instance (RADIUS scheme view)
primary authentication (RADIUS scheme view)
Use primary authentication to specify the primary RADIUS authentication server.
Use undo primary authentication to restore the default.
Syntax
primary authentication { ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | test-profile profile-name | vpn-instance vpn-instance-name | weight weight-value ] *
undo primary authentication
Default
The primary RADIUS authentication server is not specified.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies the IPv4 address of the primary RADIUS authentication server.
ipv6 ipv6-address: Specifies the IPv6 address of the primary RADIUS authentication server.
port-number: Specifies the service port number of the primary RADIUS authentication server. The value range for the UDP port number is 1 to 65535. The default setting is 1812.
key: Specifies the shared key for secure communication with the primary RADIUS authentication server.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters.
test-profile profile-name: Specifies a test profile for detecting the RADIUS server status. The profile-name argument is a case-sensitive string of 1 to 31 characters.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the primary RADIUS authentication server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
weight weight-value: Specifies a weight value for the RADIUS server. The value range for the weight-value argument is 0 to 100, and the default value is 0. The value 0 indicates that the RADIUS server will not be used for load sharing. This option takes effect only when the RADIUS server load sharing feature is enabled for the RADIUS scheme. A larger weight value represents a higher capacity to process authentication requests.
Usage guidelines
Make sure the service port and shared key settings of the primary RADIUS authentication server are the same as those configured on the server.
Two authentication servers specified for a scheme, primary or secondary, cannot have identical IP address, VPN instance, port number settings.
The shared key configured by this command takes precedence over the shared key configured with the key authentication command.
The server status detection is triggered for the server if the specified test profile exists on the device.
If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the RADIUS scheme.
If you use the primary authentication command to modify or delete the primary authentication server during an authentication process, communication with the primary server times out.
· When the RADIUS server load sharing feature is disabled, the device tries to communicate with an active server that has the highest priority for authentication.
· When the RADIUS server load sharing feature is enabled, the device performs the following operations:
a. Checks the weight value and number of currently served users for each active server.
b. Determines the most appropriate server in performance to receive an AAA request.
Examples
# In RADIUS scheme radius1, specify the primary authentication server with IP address 10.110.1.1, UDP port number 1812, and plaintext shared key 123456TESTauth&!.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] primary authentication 10.110.1.1 1812 key simple 123456TESTauth&!
Related commands
display radius scheme
key (RADIUS scheme view)
radius-server test-profile
secondary authentication (RADIUS scheme view)
server-load-sharing enable
vpn-instance (RADIUS scheme view)
radius attribute extended
Use radius attribute extended to define an extended RADIUS attribute.
Use undo radius attribute extended to delete user-defined extended RADIUS attributes.
Syntax
radius attribute extended attribute-name [ vendor vendor-id ] code attribute-code type { binary | date | integer | interface-id | ip | ipv6 | ipv6-prefix | octets | string }
undo radius attribute extended [ attribute-name ]
Default
No user-defined extended RADIUS attributes exist.
Views
System view
Predefined user roles
network-admin
Parameters
attribute-name: Specifies the RADIUS attribute name, a case-insensitive string of 1 to 63 characters. The name must be unique among all RADIUS attributes, including the standard and extended RADIUS attributes.
vendor vendor-id: Specifies a vendor ID in the range of 1 to 65535. If you do not specify a vendor ID, the device processes the RADIUS attribute as a standard RADIUS attribute. Table 7 shows the vendor IDs of supported vendors.
Table 7 Supported vendors and vendor IDs
Vendor |
Vendor ID |
Vendor |
Vendor ID |
Vendor |
Vendor ID |
HUAWEI |
2011 |
H3C |
25506 |
Microsoft |
311 |
3COM |
43 |
DSL Forum |
3561 |
China Telecom |
20942 |
Wi-Fi Alliance |
40808 |
Juniper |
2636 |
CMCC |
28357 |
Cisco |
9 |
|
|
|
|
code attribute-code: Specifies the ID of the RADIUS attribute in the attribute set. The value range for the attribute-code argument is 1 to 255.
type: Specifies a data type for the attribute content.
binary: Binary type.
date: Date type.
integer: Integer type.
interface-id: Interface ID type.
ip: IPv4 address type.
ipv6: IPv6 address type.
ipv6-prefix: IPv6 address prefix type.
octets: Octet type.
string: String type.
Usage guidelines
To support the proprietary RADIUS attributes of other vendors, perform the following tasks:
1. Use this command to define the attributes as extended RADIUS attributes.
2. Use the attribute convert command to map the extended RADIUS attributes to attributes supported by the system.
3. Use the attribute translate command to enable the RADIUS attribute translation feature for the mappings to take effect.
To cooperate with RADIUS servers of a third-party vendor, map attributes that cannot be identified by the server to server-supported attributes.
Two RADIUS attributes cannot have the same combination of attribute name, vendor ID, and attribute ID.
If you do not specify a RADIUS attribute name, the undo radius attribute extended command deletes all user-defined extended RADIUS attributes.
Examples
# Define a string-type extended RADIUS attribute with the name Owner-Password, vendor ID 122, and attribute ID 80.
<Sysname> system-view
[Sysname] radius attribute extended Owner-Password vendor 122 code 80 type string
Related commands
attribute convert (RADIUS DAS view)
attribute convert (RADIUS scheme view)
attribute reject (RADIUS DAS view)
attribute reject (RADIUS scheme view)
attribute translate
radius dscp
Use radius dscp to change the DSCP priority of RADIUS packets.
Use undo radius dscp to restore the default.
Syntax
radius [ ipv6 ] dscp dscp-value
undo radius [ ipv6 ] dscp
Default
The DSCP priority of RADIUS packets is 0.
Views
System view
Predefined user roles
network-admin
Parameters
ipv6: Specifies the IPv6 RADIUS packets. If you do not specify this keyword, the command sets the DSCP priority for the IPv4 RADIUS packets.
dscp-value: Specifies the DSCP priority of RADIUS packets, in the range of 0 to 63. A larger value represents a higher priority.
Usage guidelines
Use this command to set the DSCP priority in the ToS field of RADIUS packets for changing their transmission priority.
Examples
# Set the DSCP priority of IPv4 RADIUS packets to 10.
<Sysname> system-view
[Sysname] radius dscp 10
radius dynamic-author server
Use radius dynamic-author server to enable the RADIUS DAS feature and enter RADIUS DAS view.
Use undo radius dynamic-author server to disable the RADIUS DAS feature.
Syntax
radius dynamic-author server
undo radius dynamic-author server
Default
The RADIUS DAS feature is disabled.
Views
System view
Predefined user roles
network-admin
Usage guidelines
After you enable the RADIUS DAS feature, the device listens to the RADIUS DAS port to receive DAE packets from specified DACs.
Examples
# Enable the RADIUS DAS feature and enter RADIUS DAS view.
<Sysname> system-view
[Sysname] radius dynamic-author server
[Sysname-radius-da-server]
Related commands
client
port
radius nas-ip
Use radius nas-ip to specify a NAS IP address for RADIUS packets.
Use undo radius nas-ip to remove the NAS IP address of the specified type for RADIUS packets.
Syntax
radius nas-ip { ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ]
undo radius nas-ip { ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ]
Default
The NAS IP address of RADIUS packets is the primary IPv4 address or the IPv6 address of the packet outbound interface.
Views
System view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies an IPv4 address. The IP address cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address.
ipv6 ipv6-address: Specifies an IPv6 address, which must be a unicast address and cannot be a loopback address or a link-local address.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the NAS IP address belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. To configure a public-network NAS IP address, do not specify this option.
Usage guidelines
Use this command to specify a NAS IP address for the NAS to carry in the NAS-IP-Address or NAS-IPv6-Address attribute in outgoing RADIUS packets. The NAS IP address must be unique for a RADIUS server to identify the NAS.
The NAS can also use the NAS IP address to match incoming RADIUS packets. For example, if the NAS receives a DAE request that contains a NAS IP address, it compares the NAS IP address in the request with the local NAS IP address. The NAS can process this request only when its NAS IP address is the same as the NAS IP address in the request.
You can specify the NAS IP address in interface view, RADIUS scheme view, and system view.
· The NAS IP address specified by using the aaa nas-ip command in interface view applies only to users that access the network through the interface.
· The NAS IP address specified by using the nas-ip command in RADIUS scheme view applies only to the RADIUS scheme.
· The NAS IP address specified by using the radius nas-ip command in system view applies to all RADIUS schemes.
The priority order is as follows:
1. The NAS IP address specified in interface view.
2. The NAS IP address specified in RADIUS scheme view.
3. The NAS IP address specified in system view.
You can specify a maximum of 16 NAS IP addresses in system view, including:
· Zero or one public-network NAS IPv4 address.
· Zero or one public-network NAS IPv6 address.
· Private-network NAS IP addresses.
Each VPN instance can have only one private-network NAS IPv4 address and one private-network NAS IPv6 address in system view.
Examples
# Specify IP address 129.10.10.1 as the NAS IPv4 address of RADIUS packets.
<Sysname> system-view
[Sysname] radius nas-ip 129.10.10.1
Related commands
aaa nas-ip
nas-ip (RADIUS scheme view)
radius scheme
Use radius scheme to create a RADIUS scheme and enter its view, or enter the view of an existing RADIUS scheme.
Use undo radius scheme to delete a RADIUS scheme.
Syntax
radius scheme radius-scheme-name
undo radius scheme radius-scheme-name
Default
No RADIUS schemes exist.
Views
System view
Predefined user roles
network-admin
Parameters
radius-scheme-name: Specifies the RADIUS scheme name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
A RADIUS scheme can be used by more than one ISP domain at the same time.
The device supports a maximum of 16 RADIUS schemes.
Examples
# Create a RADIUS scheme named radius1 and enter RADIUS scheme view.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1]
Related commands
display radius scheme
radius session-control client
Use radius session-control client to specify a RADIUS session-control client.
Use undo radius session-control client to remove the specified RADIUS session-control clients.
Syntax
radius session-control client { ip ipv4-address | ipv6 ipv6-address } [ key { cipher | simple } string | vpn-instance vpn-instance-name ] *
undo radius session-control client { all | { ip ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] }
Default
No RADIUS session-control clients are specified.
Views
System view
Predefined user roles
network-admin
Parameters
ip ipv4-address: Specifies a session-control client by its IPv4 address.
ipv6 ipv6-address: Specifies a session-control client by its IPv6 address.
key: Specifies the shared key for secure communication with the session-control client.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the RADIUS session-control client belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the client is on the public network, do not specify this option.
all: Specifies all session-control clients.
Usage guidelines
To verify the session-control packets sent from a RADIUS server running on IMC, specify the RADIUS server as a session-control client to the device. The device matches a session-control packet to a session-control client based on the IP address and VPN instance, and then uses the shared key of the matched client to validate the packet.
The device searches the session-control client settings prior to searching all RADIUS scheme settings for a server with matching settings. This process narrows the search scope for finding the matched RADIUS server.
The session-control client settings take effect only when the RADIUS session-control feature is enabled.
The session-control client settings for a RADIUS server must be the same as the corresponding settings on that RADIUS server.
You can specify multiple session-control clients on the device.
Examples
# Specify a session-control client with IP address 10.110.1.2 and shared key 12345 in plaintext form.
<Sysname> system-view
[Sysname] radius session-control client ip 10.110.1.2 key simple 12345
Related commands
radius session-control enable
radius session-control enable
Use radius session-control enable to enable the RADIUS session-control feature.
Use undo radius session-control enable to disable the RADIUS session-control feature.
Syntax
radius session-control enable
undo radius session-control enable
Default
The RADIUS session-control feature is disabled.
Views
System view
Predefined user roles
network-admin
Usage guidelines
An H3C IMC RADIUS server uses session-control packets to deliver dynamic authorization change requests or disconnection requests to the device. The session-control feature enables the device to receive the RADIUS session-control packets on UDP port 1812.
This feature must work with H3C IMC servers.
Examples
# Enable the RADIUS session-control feature.
<Sysname> system-view
[Sysname] radius session-control enable
radius-server test-profile
Use radius-server test-profile to configure a test profile for detecting the RADIUS server status.
Use undo radius-server test-profile to delete a RADIUS test profile.
Syntax
radius-server test-profile profile-name username name [ interval [ second ] interval ]
undo radius-server test-profile profile-name
Default
No RADIUS test profiles exist.
Views
System view
Predefined user roles
network-admin
Parameters
profile-name: Specifies the name of the test profile, which is a case-sensitive string of 1 to 31 characters.
username name: Specifies the username in the detection packets. The name argument is a case-sensitive string of 1 to 253 characters.
interval: Specifies the server status detection interval. The default value is 60 minutes.
second: Uses second as the unit of the server status detection interval. If you do not specify this keyword, minute is used as the interval unit.
interval: Specifies the server status detection interval. If the interval unit is minute, the value range for this argument is 1 to 3600. If the interval unit is second, the value range for this argument is 10 to 216000.
Usage guidelines
You can execute this command multiple times to configure multiple test profiles.
If you specify a nonexistent test profile for a RADIUS server, the device does not detect the status of the server until you create the test profile on the device.
When you delete a test profile, the device stops detecting the status of the RADIUS servers that use the test profile.
Examples
# Configure a test profile named abc for RADIUS server status detection. The detection packet uses admin as the username and is sent every 10 minutes.
<Sysname> system-view
[Sysname] radius-server test-profile abc username admin interval 10
Related commands
primary authentication (RADIUS scheme view)
secondary authentication (RADIUS scheme view)
reset radius statistics
Use reset radius statistics to clear RADIUS packet statistics.
Syntax
reset radius statistics [ server { ip ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] [ port port-number ] { accounting | authentication } ]
Views
User view
Predefined user roles
network-admin
Parameters
server: Specifies a RADIUS server.
ip ipv4-address: Specifies the IPv4 address of the RADIUS server.
ipv6 ipv6-address: Specifies the IPv6 address of the RADIUS server.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the RADIUS server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
port port-number: Specifies the service port number of the RADIUS server. The value range for the UDP port number is 1 to 65535. The default authentication port number is 1812 and the default accounting port number is 1813.
accounting: Specifies the RADIUS accounting packet statistics.
authentication: Specifies the RADIUS authentication packet statistics.
Usage guidelines
Use this command to clear statistics about RADIUS packets exchanged between the device and RADIUS servers, including authentication packets, accounting packets, DAE packets, and session-control packets.
If you do not specify any parameters, this command clears statistics about all types of RADIUS packets exchanged between the device and all RADIUS servers.
To obtain RADIUS packet statistics in a period, first use the reset radius statistics command to clear RADIUS packet statistics. After a period of time, use the display radius statistics command to display RADIUS packet statistics.
If you specify a RADIUS server, this command clears statistics about RADIUS authentication or accounting packets exchanged between the device and the specified RADIUS server. However, the clear operation does not reduce the overall statistics in the output from the display radius statistics command.
Examples
# Clear all RADIUS packet statistics.
<Sysname> reset radius statistics
# Clear RADIUS accounting packet statistics for the RADIUS server at 1.1.1.1 with accounting port 1813.
<Sysname> reset radius statistics server ip 1.1.1.1 port 1813 accounting
Related commands
display radius statistics
reset stop-accounting-buffer (for RADIUS)
Use reset stop-accounting-buffer to clear buffered RADIUS stop-accounting requests to which no responses have been received.
Syntax
reset stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time end-time | user-name user-name }
Views
User view
Predefined user roles
network-admin
Parameters
radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.
session-id session-id: Specifies a session by its ID. The session-id argument is a string of 1 to 64 characters and cannot contain a letter. A session ID uniquely identifies an online user for a RADIUS scheme.
time-range start-time end-time: Specifies a time range. The start time and end time must be in the format of hh:mm:ss-mm/dd/yyyy or hh:mm:ss-yyyy/mm/dd.
user-name user-name: Specifies a user by its name, a case-sensitive string of 1 to 255 characters. Whether the user-name argument should include the domain name depends on the setting configured by using the user-name-format command for the RADIUS scheme.
Examples
# Clear nonresponded RADIUS stop-accounting requests buffered for user user0001@test.
<Sysname> reset stop-accounting-buffer user-name user0001@test
# Clear nonresponded RADIUS stop-accounting requests buffered from 0:0:0 to 23:59:59 on May 31, 2019.
<Sysname> reset stop-accounting-buffer time-range 00:00:00-05/31/2019 23:59:59-05/31/2019
Related commands
display stop-accounting-buffer (for RADIUS)
stop-accounting-buffer enable (RADIUS scheme view)
retry
Use retry to set the maximum number of attempts for transmitting a RADIUS packet to a single RADIUS server.
Use undo retry to restore the default.
Syntax
retry retries
undo retry
Default
The maximum number of RADIUS packet transmission attempts is 3.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
retries: Specifies the maximum number of RADIUS packet transmission attempts, in the range of 1 to 20.
Usage guidelines
Because RADIUS uses UDP packets to transmit data, the communication is not reliable.
If the device does not receive a response to its request from the RADIUS server within the response timeout period, the device retransmits the RADIUS request. To set the response timeout period, use the timer response-timeout command.
If the device does not receive a response from the RADIUS server after the maximum number of transmission attempts is reached, the device considers the request a failure.
If the client times out during the authentication process, the user is immediately logged off. To avoid user logoffs, the value multiplied by the following items cannot be larger than the client timeout period defined by the access module:
· The maximum number of RADIUS packet transmission attempts.
· The RADIUS server response timeout period.
· The number of RADIUS authentication servers in the RADIUS scheme.
When the device sends a RADIUS request to a new RADIUS server, it checks the total amount of time it has taken to transmit the RADIUS packet. If the amount of time has reached 300 seconds, the device stops sending the RADIUS request to the next RADIUS server. As a best practice, consider the number of RADIUS servers when you configure the maximum number of packet transmission attempts and the RADIUS server response timeout period.
Examples
# In RADIUS scheme radius1, set the maximum number of RADIUS packet transmission attempts to 5.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] retry 5
Related commands
radius scheme
timer response-timeout (RADIUS scheme view)
retry realtime-accounting
Use retry realtime-accounting to set the maximum number of accounting attempts.
Use undo retry realtime-accounting to restore the default.
Syntax
retry realtime-accounting retries
undo retry realtime-accounting
Default
The maximum number of accounting attempts is 5.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
retries: Specifies the maximum number of accounting attempts, in the range of 1 to 255.
Usage guidelines
Typically, a RADIUS accounting server checks whether a user is online by using a timeout timer. If the server does not receive a real-time accounting request for a user in the timeout period, it considers that a line or device failure has occurred. The server stops accounting for the user.
To work with the RADIUS server, the NAS needs to send real-time accounting requests to the server before the timer on the server expires and to keep pace with the server in disconnecting the user when a failure occurs. The NAS disconnects from a user according to the maximum number of accounting attempts and specific parameters.
For example, the following conditions exist:
· The RADIUS server response timeout period is 3 seconds (set by using the timer response-timeout command).
· The maximum number of RADIUS packet transmission attempts is 3 (set by using the retry command).
· The real-time accounting interval is 12 minutes (set by using the timer realtime-accounting command).
· The maximum number of accounting attempts is 5 (set by using the retry realtime-accounting command).
In the above case, the device generates an accounting request every 12 minutes, and retransmits the request if it sends the request but receives no response within 3 seconds. If the device receives no response after transmitting the request three times, it considers the accounting attempt a failure, and makes another accounting attempt. If five consecutive accounting attempts fail, the device cuts the user connection.
Examples
# In RADIUS scheme radius1, set the maximum number of accounting attempts to 10.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] retry realtime-accounting 10
Related commands
retry
timer realtime-accounting (RADIUS scheme view)
timer response-timeout (RADIUS scheme view)
retry stop-accounting (RADIUS scheme view)
Use retry stop-accounting to set the maximum number of transmission attempts for individual RADIUS stop-accounting requests.
Use undo retry stop-accounting to restore the default.
Syntax
retry stop-accounting retries
undo retry stop-accounting
Default
The maximum number of transmission attempts is 500 for individual RADIUS stop-accounting requests.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
retries: Specifies the maximum number of transmission attempts. The value range is 10 to 65535.
Usage guidelines
The maximum number of stop-accounting request transmission attempts controls the transmission of stop-accounting requests together with the following parameters:
· RADIUS server response timeout timer (set by using the timer response-timeout command).
· Maximum number of times to transmit a RADIUS packet per round (set by using the retry command).
For example, the following settings exist:
· The RADIUS server response timeout timer is 3 seconds.
· The maximum number of times to transmit a RADIUS packet per round is five.
· The maximum number of stop-accounting request transmission attempts is 20.
A stop-accounting request is retransmitted if the device does not receive a response within 3 seconds. When all five transmission attempts in this round are used, the device buffers the request and starts another round of retransmission. If 20 consecutive rounds of attempts fail, the device discards the request.
Examples
# Set the maximum number of stop-accounting request transmission attempts to 1000 for RADIUS scheme radius1.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] retry stop-accounting 1000
Related commands
display stop-accounting-buffer (for RADIUS)
retry
timer response-timeout (RADIUS scheme view)
secondary accounting (RADIUS scheme view)
Use secondary accounting to specify a secondary RADIUS accounting server.
Use undo secondary accounting to remove a secondary RADIUS accounting server.
Syntax
secondary accounting { ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | vpn-instance vpn-instance-name | weight weight-value ] *
undo secondary accounting [ { ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ]
Default
No secondary RADIUS accounting servers are specified.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies the IPv4 address of the secondary RADIUS accounting server.
ipv6 ipv6-address: Specifies the IPv6 address of the secondary RADIUS accounting server.
port-number: Specifies the service port number of the secondary RADIUS accounting server. The value range for the UDP port number is 1 to 65535. The default setting is 1813.
key: Specifies the shared key for secure communication with the secondary RADIUS accounting server.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary RADIUS accounting server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
weight weight-value: Specifies a weight value for the RADIUS server. The value range for the weight-value argument is 0 to 100, and the default value is 0. The value 0 indicates that the RADIUS server will not be used for load sharing. This option takes effect only when the RADIUS server load sharing feature is enabled for the RADIUS scheme. A larger weight value represents a higher capacity to process accounting requests.
Usage guidelines
Make sure the port number and shared key settings of each secondary RADIUS accounting server are the same as those configured on the corresponding server.
A RADIUS scheme supports a maximum of 16 secondary RADIUS accounting servers. If the primary server fails, the device tries to communicate with a secondary server in active state. The device connects to the secondary servers in the order they are configured.
Two accounting servers specified for a scheme, primary or secondary, cannot have identical IP address, VPN instance, and port number settings.
The shared key configured by this command takes precedence over the shared key configured with the key accounting command.
If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the RADIUS scheme.
If you use the secondary accounting command to modify or delete a secondary accounting server to which the device is sending a start-accounting request, communication with the secondary server times out.
· When the RADIUS server load sharing feature is disabled, the device tries to communicate with an active server that has the highest priority for accounting.
· When the RADIUS server load sharing feature is enabled, the device returns an accounting failure message rather than searching for another active accounting server.
If you remove an actively used accounting server, the device no longer sends users' real-time accounting requests and stop-accounting requests. The device does not buffer the stop-accounting requests, either.
Examples
# In RADIUS scheme radius1, specify a secondary accounting server with IP address 10.110.1.1 and UDP port 1813.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] secondary accounting 10.110.1.1 1813
# In RADIUS scheme radius2, specify two secondary accounting servers with IP addresses 10.110.1.1 and 10.110.1.2 and UDP port 1813.
<Sysname> system-view
[Sysname] radius scheme radius2
[Sysname-radius-radius2] secondary accounting 10.110.1.1 1813
[Sysname-radius-radius2] secondary accounting 10.110.1.2 1813
Related commands
display radius scheme
key (RADIUS scheme view)
primary accounting (RADIUS scheme view)
vpn-instance (RADIUS scheme view)
secondary authentication (RADIUS scheme view)
Use secondary authentication to specify a secondary RADIUS authentication server.
Use undo secondary authentication to remove a secondary RADIUS authentication server.
Syntax
secondary authentication { ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | test-profile profile-name | vpn-instance vpn-instance-name | weight weight-value ] *
undo secondary authentication [ { ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ]
Default
No secondary RADIUS authentication servers are specified.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies the IPv4 address of the secondary RADIUS authentication server.
ipv6 ipv6-address: Specifies the IPv6 address of the secondary RADIUS authentication server.
port-number: Sets the service port number of the secondary RADIUS authentication server. The value range for the UDP port number is 1 to 65535. The default setting is 1812.
key: Specifies the shared key for secure communication with the secondary RADIUS authentication server.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters.
test-profile profile-name: Specifies a test profile for detecting the RADIUS server status. The profile-name argument is a case-sensitive string of 1 to 31 characters.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary RADIUS authentication server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
weight weight-value: Specifies a weight value for the RADIUS server. The value range for the weight-value argument is 0 to 100, and the default value is 0. The value 0 indicates that the RADIUS server will not be used for load sharing. This option takes effect only when the RADIUS server load sharing feature is enabled for the RADIUS scheme. A larger weight value represents a higher capacity to process authentication requests.
Usage guidelines
Make sure the port number and shared key settings of each secondary RADIUS authentication server are the same as those configured on the corresponding server.
A RADIUS scheme supports a maximum of 16 secondary RADIUS authentication servers. If the primary server fails, the device tries to communicate with a secondary server in active state. The device connects to the secondary servers in the order they are configured.
The server status detection is triggered for a server if the specified test profile exists on the device.
Two authentication servers specified for a scheme, primary or secondary, cannot have identical IP address, VPN instance, and port number settings.
The shared key configured by this command takes precedence over the shared key configured with the key authentication command.
If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the RADIUS scheme.
If you use the secondary authentication command to modify or delete a secondary authentication server during an authentication process, communication with the secondary server times out.
· When the RADIUS server load sharing feature is disabled, the device tries to communicate with an active server that has the highest priority for authentication.
· When the RADIUS server load sharing feature is enabled, the device performs the following operations:
a. Checks the weight value and number of currently served users for each active server.
b. Determines the most appropriate server in performance to receive an AAA request.
Examples
# In RADIUS scheme radius1, specify a secondary authentication server with IP address 10.110.1.2 and UDP port 1812.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] secondary authentication 10.110.1.2 1812
# In RADIUS scheme radius2, specify two secondary authentication servers with IP addresses 10.110.1.1 and 10.110.1.2 and UDP port 1812.
<Sysname> system-view
[Sysname] radius scheme radius2
[Sysname-radius-radius2] secondary authentication 10.110.1.1 1812
[Sysname-radius-radius2] secondary authentication 10.110.1.2 1812
Related commands
display radius scheme
key (RADIUS scheme view)
primary authentication (RADIUS scheme view)
radius-server test-profile
vpn-instance (RADIUS scheme view)
server-load-sharing enable
Use server-load-sharing enable to enable the RADIUS server load sharing feature.
Use undo server-load-sharing enable to disable the RADIUS server load sharing feature.
Syntax
server-load-sharing enable
undo server-load-sharing enable
Default
The RADIUS server load sharing feature is disabled.
Views
RADIUS scheme view
Predefined user roles
network-admin
Usage guidelines
Use the RADIUS server load sharing feature to dynamically distribute the workload over multiple servers regardless of their server roles. The device forwards an AAA request to the most appropriate server of all active servers in the scheme after it compares the weight values and number of currently served users. Specify a weight value for each RADIUS server based on the AAA capacity of the server. A larger weight value indicates a higher AAA capacity.
In RADIUS server load sharing, once the device sends a start-accounting request to a server for a user, it forwards all subsequent accounting requests of the user to the same server. If the accounting server is unreachable, the device returns an accounting failure message rather than searching for another active accounting server.
Examples
# Enable the RADIUS server load sharing feature for RADIUS scheme radius1.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] server-load-sharing enable
Related commands
display radius server-load statistics
primary authentication (RADIUS scheme view)
primary accounting (RADIUS scheme view)
secondary authentication (RADIUS scheme view)
secondary accounting (RADIUS scheme view)
server-load-sharing mode
server-load-sharing mode
Use server-load-sharing mode to specify the RADIUS authentication server load sharing mode.
Use undo server-load-sharing mode to restore the default.
Syntax
server-load-sharing mode { packet-based | session-based }
undo server-load-sharing mode
Default
The RADIUS authentication server load sharing mode is session-based.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
packet-based: Specifies the packet-based mode.
session-based: Specifies the session-based mode.
Usage guidelines
The RADIUS authentication server load sharing mode controls the workload distribution only for RADIUS authentication servers.
This command takes effect only when the RADIUS server load sharing feature is enabled.
When the RADIUS server load sharing feature is enabled for a RADIUS scheme, the device supports the following modes to distribute workload to authentication servers in the scheme:
· Session-based mode—The device forwards a RADIUS authentication request to the most appropriate server among all active servers in the scheme after it compares their weights and number of concurrent active sessions.
Each time the device sends an authentication request to a server, the number of concurrent sessions to that server increases by one. Each time the device receives an authentication response from a server, the number of concurrent sessions to that server decreases by one.
This mode is applicable if the number of concurrent sessions on the network is large and the servers have similar performance.
· Packet-based mode—The device forwards a RADIUS authentication request to the most appropriate server among all active servers in the scheme after it compares their weights and number of received authentication requests.
Each time the device sends an authentication request to a server, the number of received packets to that server increases by one.
To evenly distribute authentication requests to all active servers in the scheme, specify the packet-based RADIUS server load sharing mode.
Examples
# Specify the packet-based RADIUS authentication server load sharing mode for RADIUS scheme radius1.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] server-load-sharing mode packet-based
Related commands
server-load-sharing enable
snmp-agent trap enable radius
Use snmp-agent trap enable radius to enable SNMP notifications for RADIUS.
Use undo snmp-agent trap enable radius to disable SNMP notifications for RADIUS.
Syntax
snmp-agent trap enable radius [ accounting-server-down | accounting-server-up | authentication-error-threshold | authentication-server-down | authentication-server-up ] *
undo snmp-agent trap enable radius [ accounting-server-down | accounting-server-up | authentication-error-threshold | authentication-server-down | authentication-server-up ] *
Default
All RADIUS SNMP notifications are disabled.
Views
System view
Predefined user roles
network-admin
Parameters
accounting-server-down: Specifies notifications to be sent when the RADIUS accounting server becomes unreachable.
accounting-server-up: Specifies notifications to be sent when the RADIUS accounting server becomes reachable.
authentication-error-threshold: Specifies notifications to be sent when the number of authentication failures exceeds the specified threshold. The threshold is represented by the ratio of the authentication failures to the total number of authentication attempts. The value range is 1 to 100, and the default value is 30. This threshold can only be configured through the MIB.
authentication-server-down: Specifies notifications to be sent when the RADIUS authentication server becomes unreachable.
authentication-server-up: Specifies notifications to be sent when the RADIUS authentication server becomes reachable.
Usage guidelines
If you do not specify any keywords, this command enables or disables all types of notifications for RADIUS.
When SNMP notifications for RADIUS are enabled, the device supports the following notifications generated by RADIUS:
· RADIUS server unreachable notification—The RADIUS server cannot be reached. RADIUS generates this notification if it cannot receive any response to an accounting or authentication request within the specified RADIUS request transmission attempts.
· RADIUS server reachable notification—The RADIUS server can be reached. RADIUS generates this notification for a previously blocked RADIUS server after the quiet timer expires.
· Excessive authentication failures notification—RADIUS generates this notification when the number of authentication failures to the total number of authentication attempts exceeds the specified threshold.
Examples
# Enable the device to send RADIUS accounting server unreachable notifications.
<Sysname> system-view
[Sysname] snmp-agent trap enable radius accounting-server-down
state primary
Use state primary to set the status of a primary RADIUS server.
Syntax
state primary { accounting | authentication } { active | block }
Default
A primary RADIUS server is in active state.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
accounting: Specifies the primary RADIUS accounting server.
authentication: Specifies the primary RADIUS authentication server.
active: Specifies the active state, the normal operation state.
block: Specifies the blocked state, the out-of-service state.
Usage guidelines
When the RADIUS server load sharing feature is disabled, the device first tries to communicate with the primary server if the primary server is in active state. If the primary server is unavailable, the device performs the following operations:
· Changes the status of the primary server to blocked.
· Starts a quiet timer for the server.
· Tries to communicate with a secondary server in active state.
When the quiet timer of the primary server times out, the status of the server automatically changes to active. If you set the server status to blocked before the quiet timer times out, the server status cannot change back to active unless you manually set the status to active.
When the RADIUS server load sharing feature is enabled and active servers exist, the device checks the workload on each active server, and then selects the most appropriate server in performance for communication.
This command can affect the RADIUS server status detection feature when a valid test profile is specified for a primary RADIUS authentication server.
· If you set the status of the server to blocked, the device stops detecting the status of the server.
· If you set the status of the server to active, the device starts to detect the status of the server.
Examples
# In RADIUS scheme radius1, set the status of the primary authentication server to blocked.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] state primary authentication block
Related commands
display radius scheme
radius-server test-profile
server-load-sharing enable
state secondary
state secondary
Use state secondary to set the status of a secondary RADIUS server.
Syntax
state secondary { accounting | authentication } [ { ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ] { active | block }
Default
A secondary RADIUS server is in active state.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
accounting: Specifies a secondary RADIUS accounting server.
authentication: Specifies a secondary RADIUS authentication server.
ipv4-address: Specifies the IPv4 address of a secondary RADIUS server.
ipv6 ipv6-address: Specifies the IPv6 address of a secondary RADIUS server.
port-number: Sets the service port number of a secondary RADIUS server. The value range for the UDP port number is 1 to 65535. The default port numbers for authentication and accounting are 1812 and 1813, respectively.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary RADIUS server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters.
active: Specifies the active state, the normal operation state.
block: Specifies the blocked state, the out-of-service state.
Usage guidelines
If you do not specify an IP address, this command changes the status of all configured secondary RADIUS servers.
If the device finds that a secondary server in active state is unreachable, the device performs the following operations:
· Changes the status of the secondary server to blocked.
· Starts a quiet timer for the server.
· Tries to communicate with another secondary server in active state.
When the quiet timer of a server times out, the status of the server automatically changes to active. If you set the server status to blocked before the quiet timer times out, the server status cannot change back to active unless you manually set the status to active. If all configured secondary servers are unreachable, the device considers the authentication or accounting attempt a failure.
When the RADIUS server load sharing feature is enabled and active servers exist, the device checks the workload on each active server, and then selects the most appropriate server in performance for communication.
This command can affect the RADIUS server status detection feature when a valid test profile is specified for a secondary RADIUS authentication server.
· If you set the status of the server to blocked, the device stops detecting the status of the server.
· If you set the status of the server to active, the device starts to detect the status of the server.
Examples
# In RADIUS scheme radius1, set the status of all the secondary authentication servers to blocked.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] state secondary authentication block
Related commands
display radius scheme
radius-server test-profile
server-load-sharing enable
state primary
stop-accounting-buffer enable (RADIUS scheme view)
Use stop-accounting-buffer enable to enable buffering of RADIUS stop-accounting requests to which no responses have been received.
Use undo stop-accounting-buffer enable to disable the buffering feature.
Syntax
stop-accounting-buffer enable
undo stop-accounting-buffer enable
Default
The device buffers the RADIUS stop-accounting requests to which no responses have been received.
Views
RADIUS scheme view
Predefined user roles
network-admin
Usage guidelines
This command enables the device to buffer a RADIUS stop-accounting request that has no response after the maximum transmission attempts (set by using the retry command) have been made. The device resends the buffered request until it receives a server response or when the number of stop-accounting request transmission attempts reaches the upper limit. If no more attempts are available, the device discards the request. However, if you have removed an accounting server, stop-accounting requests destined for the server are not buffered.
Examples
# Enable buffering of RADIUS stop-accounting requests to which no responses have been received.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] stop-accounting-buffer enable
Related commands
display stop-accounting-buffer (for RADIUS)
reset stop-accounting-buffer (for RADIUS)
stop-accounting-packet send-force
Use stop-accounting-packet send-force to enable forcibly sending RADIUS stop-accounting packets. The device will send RADIUS stop-accounting packets when users for which no RADIUS start-accounting packets are sent go offline.
Use undo stop-accounting-packet send-force to disable forcibly sending RADIUS stop-accounting packets.
Syntax
stop-accounting-packet send-force
undo stop-accounting-packet send-force
Default
Forcibly sending RADIUS stop-accounting packets is disabled. The device does not send RADIUS stop-accounting packets when users for which no RADIUS start-accounting packets are sent go offline.
Views
RADIUS scheme view
Predefined user roles
network-admin
Usage guidelines
Typically, if the device does not send a RADIUS start-accounting packet to the RADIUS server for an authenticated user, it does not send a RADIUS stop-accounting packet when the user goes offline. If the server has generated a user entry for the user without RADIUS start-accounting packets, it does not release the user entry when the user goes offline. This feature forces the device to send RADIUS stop-accounting packets to the RADIUS server when the user goes offline for timely releasing the user entry on the server.
Examples
# In RADIUS scheme radius1, enable forcibly sending RADIUS stop-accounting packets.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] stop-accounting-packet send-force
Related commands
display radius scheme
timer quiet (RADIUS scheme view)
Use timer quiet to set the quiet timer for the servers specified in a RADIUS scheme.
Use undo timer quiet to restore the default.
Syntax
timer quiet minutes
undo timer quiet
Default
The server quiet timer period is 5 minutes in a RADIUS scheme.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
minutes: Specifies the server quiet period in minutes, in the range of 1 to 255.
Usage guidelines
Make sure the server quiet timer is set correctly.
A timer that is too short might result in frequent authentication or accounting failures. This is because the device will continue to attempt to communicate with an unreachable server that is in active state.
A timer that is too long might temporarily block a reachable server that has recovered from a failure. This is because the server will remain in blocked state until the timer expires.
Examples
# In RADIUS scheme radius1, set the quiet timer to 10 minutes for the servers.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] timer quiet 10
Related commands
display radius scheme
timer realtime-accounting (RADIUS scheme view)
Use timer realtime-accounting to set the real-time accounting interval.
Use undo timer realtime-accounting to restore the default.
Syntax
timer realtime-accounting interval [ second ]
undo timer realtime-accounting
Default
The real-time accounting interval is 12 minutes.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
interval: Specifies the real-time accounting interval in the range of 0 to 71582.
second: Specifies the measurement unit as second. If you do not specify this keyword, the real-time accounting interval is measured in minutes.
Usage guidelines
When the real-time accounting interval on the device is not zero, the device sends online user accounting information to the RADIUS accounting server at the configured interval.
When the real-time accounting interval on the device is zero, the device sends online user accounting information to the RADIUS accounting server at the real-time accounting interval configured on the server. If the real-time accounting interval is not configured on the server, the device does not send online user accounting information.
If a user uses RADIUS accounting but not RADIUS authentication and authorization, the device performs real-time accounting for that user only based on the real-time accounting interval set in the user's RADIUS accounting scheme. The real-time accounting interval assigned by the RADIUS accounting server does not take effect.
A short interval helps improve accounting precision but requires many system resources. As a best practice, set the interval to a value greater than the product of the maximum RADIUS packet transmission attempts and the RADIUS server response timeout timer.
Table 8 Recommended real-time accounting intervals
Number of users |
Real-time accounting interval |
1 to 99 |
3 minutes |
100 to 499 |
6 minutes |
500 to 999 |
12 minutes |
1000 or more |
15 minutes or longer |
When you modify the real-time accounting interval, the following rules apply to users that have been online before the modification:
· If you modify the real-time accounting interval from a non-zero value to zero or from zero to a non-zero value, the modification does not take effect on these users. These users still use the old real-time accounting interval.
· If you modify the real-time accounting interval from a non-zero value to another non-zero value, the modification takes effect immediately on these users.
The device sends a start-accounting packet for a dual-stack user after the user obtains an IP address of one stack. No matter how long the real-time accounting interval is, the device sends an update-accounting packet for the user immediately after the user obtains an IP address of another stack.
Examples
# In RADIUS scheme radius1, set the real-time accounting interval to 51 minutes.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] timer realtime-accounting 51
Related commands
retry
retry realtime-accounting
timer response-timeout (RADIUS scheme view)
timer response-timeout (RADIUS scheme view)
Use timer response-timeout to set the RADIUS server response timeout timer.
Use undo timer response-timeout to restore the default.
Syntax
timer response-timeout seconds
undo timer response-timeout
Default
The RADIUS server response timeout period is 3 seconds.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
seconds: Specifies the RADIUS server response timeout period, in the range of 1 to 10 seconds.
Usage guidelines
If a NAS receives no response from the RADIUS server in a period of time after sending a RADIUS request, it resends the request so that the user has more opportunity to obtain the RADIUS service. The NAS uses the RADIUS server response timeout timer to control the transmission interval.
If the client times out during the authentication process, the user is immediately logged off. To avoid user logoffs, the value multiplied by the following items cannot be larger than the client timeout period defined by the access module:
· The maximum number of RADIUS packet transmission attempts.
· The RADIUS server response timeout period.
· The number of RADIUS servers in the RADIUS scheme.
When the device sends a RADIUS request to a new RADIUS server, it checks the total amount of time it has taken to transmit the RADIUS packet. If the amount of time has reached 300 seconds, the device stops sending the RADIUS request to the next RADIUS server. As a best practice, consider the number of RADIUS servers when you configure the maximum number of packet transmission attempts and the RADIUS server response timeout period.
Examples
# In RADIUS scheme radius1, set the RADIUS server response timeout timer to 5 seconds.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] timer response-timeout 5
Related commands
display radius scheme
retry
user-name-format (RADIUS scheme view)
Use user-name-format to specify the format of the username to be sent to a RADIUS server.
Use undo user-name-format to restore the default.
Syntax
user-name-format { keep-original | with-domain | without-domain }
undo user-name-format
Default
The ISP domain name is included in the usernames sent to a RADIUS server.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
keep-original: Sends the username to the RADIUS server as the username is entered.
with-domain: Includes the ISP domain name in the username sent to the RADIUS server.
without-domain: Excludes the ISP domain name from the username sent to the RADIUS server.
Usage guidelines
A username is generally in the userid@isp-name format, of which the isp-name part is used by the device to determine the ISP domain to which a user belongs. Some earlier RADIUS servers, however, cannot recognize a username containing an ISP domain name. Before sending a username including a domain name to such a RADIUS server, the device must remove the domain name. This command allows you to specify whether to include a domain name in a username sent to a RADIUS server.
If a RADIUS scheme defines that the username is sent without the ISP domain name, do not apply the scheme to more than one ISP domain. Otherwise, the RADIUS server will consider two users in different ISP domains but with the same userid as one user.
Examples
# In RADIUS scheme radius1, configure the device to remove the domain name from the usernames sent to the RADIUS servers.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] user-name-format without-domain
Related commands
display radius scheme
vpn-instance (RADIUS scheme view)
Use vpn-instance to specify an MPLS L3VPN instance for a RADIUS scheme.
Use undo vpn-instance to restore the default.
Syntax
vpn-instance vpn-instance-name
undo vpn-instance
Default
The RADIUS scheme belongs to the public network.
Views
RADIUS scheme view
Predefined user roles
network-admin
Parameters
vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters.
Usage guidelines
The VPN instance specified for a RADIUS scheme applies to all authentication and accounting servers in that scheme. If a VPN instance is also configured for an individual RADIUS server, the VPN instance specified for the RADIUS scheme does not take effect on that server.
Examples
# Specify VPN instance test for RADIUS scheme radius1.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] vpn-instance test
Related commands
display radius scheme
HWTACACS commands
data-flow-format (HWTACACS scheme view)
Use data-flow-format to set the data flow and packet measurement units for traffic statistics.
Use undo data-flow-format to restore the default.
Syntax
data-flow-format { data { byte | giga-byte | kilo-byte | mega-byte } | packet { giga-packet | kilo-packet | mega-packet | one-packet } } *
undo data-flow-format { data | packet }
Default
Traffic is counted in bytes and packets.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
data: Specifies the unit for data flows.
byte: Specifies the unit as byte.
giga-byte: Specifies the unit as gigabyte.
kilo-byte: Specifies the unit as kilobyte.
mega-byte: Specifies the unit as megabyte.
packet: Specifies the unit for data packets.
giga-packet: Specifies the unit as giga-packet.
kilo-packet: Specifies the unit as kilo-packet.
mega-packet: Specifies the unit as mega-packet.
one-packet: Specifies the unit as one-packet.
Usage guidelines
The data flow and packet measurement units for traffic statistics must be the same as configured on the HWTACACS accounting servers. Otherwise, accounting results might be incorrect.
Examples
# In HWTACACS scheme hwt1, set the data flow and packet measurement units for traffic statistics to kilobyte and kilo-packet, respectively.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] data-flow-format data kilo-byte packet kilo-packet
display hwtacacs scheme
display hwtacacs scheme
Use display hwtacacs scheme to display the configuration or statistics of HWTACACS schemes.
Syntax
display hwtacacs scheme [ hwtacacs-scheme-name [ statistics ] ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters. If you do not specify an HWTACACS scheme, this command displays the configuration of all HWTACACS schemes.
statistics: Displays the HWTACACS service statistics. If you do not specify this keyword, the command displays the configuration of the specified HWTACACS scheme.
Examples
# Displays the configuration of all HWTACACS schemes.
<Sysname> display hwtacacs scheme
Total 1 HWTACACS schemes
------------------------------------------------------------------
HWTACACS scheme name : hwtac
Index : 0
Primary authentication server:
IP : 2.2.2.2 Port: 49 State: Active
VPN Instance: 2
Single-connection: Enabled
Primary authorization server:
IP : 2.2.2.2 Port: 49 State: Active
VPN Instance: 2
Single-connection: Disabled
Primary accounting server:
IP : Not Configured Port: 49 State: Block
VPN Instance: Not configured
Single-connection: Disabled
VPN Instance : 2
NAS IP Address : 2.2.2.3
Server Quiet Period(minutes) : 5
Realtime Accounting Interval(minutes) : 12
Stop-accounting packets buffering : Enabled
Retransmission times : 100
Response Timeout Interval(seconds) : 5
Username Format : with-domain
Data flow unit : Byte
Packet unit : One
------------------------------------------------------------------
Table 9 Command output
Field |
Description |
Index |
Index number of the HWTACACS scheme. |
Primary authentication server |
Primary HWTACACS authentication server. |
Primary authorization server |
Primary HWTACACS authorization server. |
Primary accounting server |
Primary HWTACACS accounting server. |
Secondary authentication server |
Secondary HWTACACS authentication server. |
Secondary authorization server |
Secondary HWTACACS authorization server. |
Secondary accounting server |
Secondary HWTACACS accounting server. |
IP |
IP address of the HWTACACS server. If no server is configured, this field displays Not configured. |
Port |
Service port of the HWTACACS server. If no port configuration is performed, this field displays the default port number. |
State |
Status of the HWTACACS server: active or blocked. |
VPN Instance |
MPLS L3VPN instance to which the HWTACACS server or scheme belongs. If no VPN instance is specified for the server or scheme, this field displays Not configured. |
Single-connection |
Single connection status: · Enabled—Establish only one TCP connection for all users to communicate with the server. · Disabled—Establish a TCP connection for each user to communicate with the server. |
NAS IP Address |
Source IP address for outgoing HWTACACS packets. |
Server Quiet Period(minutes) |
Quiet period for the primary servers, in minutes. |
Realtime Accounting Interval(minutes) |
Real-time accounting interval, in minutes. |
Stop-accounting packets buffering |
Whether buffering of nonresponded HWTACACS stop-accounting requests is enabled. |
Retransmission times |
Maximum number of transmission attempts for individual HWTACACS stop-accounting requests. |
Response Timeout Interval(seconds) |
HWTACACS server response timeout period, in seconds. |
Username Format |
Format for the usernames sent to the HWTACACS server: · with-domain—Includes the domain name. · without-domain—Excludes the domain name. · keep-original—Forwards the username as the username is entered. |
Data flow unit |
Measurement unit for data flows: · Byte. · Kilobyte. · Megabyte. · Gigabyte. |
Packet unit |
Measurement unit for packets: · One. · Kilo. · Mega. · Giga. |
# Display the HWTACACS service statistics.
<Sysname> display hwtacacs scheme tac statistics
HWTACACS scheme name: tac
Primary authentication server: 3.3.3.3
Round trip time: 0 seconds
Request packets: 1
Login request packets: 1
Change-password request packets: 0
Request packets including plaintext password: 0
Request packets including ciphertext password: 0
Response packets: 2
Pass response packets: 1
Failure response packets: 0
Get-data response packets: 0
Get-username response packets: 0
Get-password response packets: 1
Restart response packets: 0
Error response packets: 0
Follow response packets: 0
Malformed response packets: 0
Continue packets: 1
Continue-abort packets: 0
Pending request packets: 0
Timeout packets: 0
Unknown type response packets: 0
Dropped response packets: 0
Primary authorization server: 3.3.3.3
Round trip time: 1 seconds
Request packets: 1
Response packets: 1
PassAdd response packets: 1
PassReply response packets: 0
Failure response packets: 0
Error response packets: 0
Follow response packets: 0
Malformed response packets: 0
Pending request packets: 0
Timeout packets: 0
Unknown type response packets: 0
Dropped response packets: 0
Primary accounting server: 3.3.3.3
Round trip time: 0 seconds
Request packets: 2
Accounting start request packets: 1
Accounting stop request packets: 1
Accounting update request packets: 0
Pending request packets: 0
Response packets: 2
Success response packets: 2
Error response packets: 0
Follow response packets: 0
Malformed response packets: 0
Timeout response packets: 0
Unknown type response packets: 0
Dropped response packets: 0
Table 10 Command output
Field |
Description |
Primary authentication server |
Primary HWTACACS authentication server. |
Primary authorization server |
Primary HWTACACS authorization server. |
Primary accounting server |
Primary HWTACACS accounting server. |
Secondary authentication server |
Secondary HWTACACS authentication server. |
Secondary authorization server |
Secondary HWTACACS authorization server. |
Secondary accounting server |
Secondary HWTACACS accounting server. |
Round trip time |
Time between the device processes the latest pair of request and response, in seconds. |
Request packets |
Number of sent requests. |
Response packets |
Number of received responses. |
Failure response packets |
Number of responses for authentication or authorization failure. |
Error response packets |
Number of error authentication responses. |
Follow response packets |
Number of follow authentication responses. |
Malformed response packets |
Number of invalid responses. |
Pending request packets |
Number of requests for which the device waits for responses. |
Timeout packets |
Number of requests that timed out. |
Unknown type response packets |
Number of unknown responses. |
Dropped response packets |
Number of dropped responses. |
Login request packets |
Number of sent packets that request to log in to the device. |
Change-password request packets |
Number of sent packets that request to change user passwords. |
Request packets including plaintext passwords |
Number of sent requests that include user passwords in plaintext form. |
Request packets including ciphertext passwords |
Number of requests that include user passwords in encrypted form. |
Pass response packets |
Number of responses that indicate users pass authentication. |
Get-data response packets |
Number of responses that get data. |
Get-username response packets |
Number of responses that get usernames. |
Get-password response packets |
Number of responses that get user passwords. |
Restart response packets |
Number of responses that indicate reauthentication. |
Continue packets |
Number of sent continue packets. |
Continue-abort packets |
Number of sent continue-abort packets. |
PassAdd response packets |
Number of received PassAdd responses. This type of responses indicate that the server agrees to assign all requested authorization attributes and adds other authorization attributes. |
PassReply response packets |
Number of received PassReply responses. This type of responses indicate that the server uses the authorization attributes in the responses to replace the requested authorization attributes. |
Accounting start request packets |
Number of sent start-accounting requests. |
Accounting stop request packets |
Number of sent stop-accounting requests. |
Accounting update request packets |
Number of sent accounting-update requests. |
Success response packets |
Number of received responses that indicate accounting success. |
Related commands
reset hwtacacs statistics
display stop-accounting-buffer (for HWTACACS)
Use display stop-accounting-buffer to display information about buffered HWTACACS stop-accounting requests to which no responses have been received.
Syntax
display stop-accounting-buffer hwtacacs-scheme hwtacacs-scheme-name
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Display information about nonresponded stop-accounting requests buffered for HWTACACS scheme hwt1.
<Sysname> display stop-accounting-buffer hwtacacs-scheme hwt1
Total entries: 2
Scheme IP address Username First sending time Attempts
hwt1 192.168.100.1 abc 23:27:16-05/31/2019 19
hwt1 192.168.90.6 bob 23:33:01-05/31/2019 20
Table 11 Command output
Field |
Description |
First sending time |
Time when the stop-accounting request was first sent. |
Attempts |
Number of attempts that were made to send the stop-accounting request. |
Related commands
reset stop-accounting-buffer (for HWTACACS)
retry stop-accounting (HWTACACS scheme view)
stop-accounting-buffer enable (HWTACACS scheme view)
user-name-format (HWTACACS scheme view)
hwtacacs nas-ip
Use hwtacacs nas-ip to specify a source IP address for outgoing HWTACACS packets.
Use undo hwtacacs nas-ip to delete a source IP address for outgoing HWTACACS packets.
Syntax
hwtacacs nas-ip { ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ]
undo hwtacacs nas-ip { ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ]
Default
The source IP address of an HWTACACS packet sent to the server is the primary IP address of the outbound interface.
Views
System view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies an IPv4 address, which must be an address of the device. The IP address cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address.
ipv6 ipv6-address: Specifies an IPv6 address, which must be a unicast address of the device and cannot be a loopback address or a link-local address.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the source IP address belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. To configure a public-network source IP address, do not specify this option.
Usage guidelines
The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS that is configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon receiving an HWTACACS packet, the HWTACACS server checks the source IP address of the packet.
· If the source IP address belongs to a managed NAS, the server processes the packet.
· If the source IP address does not belong to a managed NAS, the server drops the packet.
As a best practice to avoid HWTACACS packet loss caused by physical port errors, specify a loopback interface address as the source IP address of outgoing HWTACACS packets.
If you use both the nas-ip command and hwtacacs nas-ip command, the following guidelines apply:
· The setting configured by using the nas-ip command in HWTACACS scheme view applies only to the HWTACACS scheme.
· The setting configured by using the hwtacacs nas-ip command in system view applies to all HWTACACS schemes.
· The setting in HWTACACS scheme view takes precedence over the setting in system view.
You can specify a maximum of 16 source IP addresses in system view, including:
· Zero or one public-network source IPv4 address.
· Zero or one public-network source IPv6 address.
· Private-network source IP addresses.
Each VPN instance can have only one private-network source IPv4 address and one private-network source IPv6 address in system view.
Examples
# Specify IP address 129.10.10.1 as the source address of outgoing HWTACACS packets.
<Sysname> system-view
[Sysname] hwtacacs nas-ip 129.10.10.1
Related commands
nas-ip (HWTACACS scheme view)
hwtacacs scheme
Use hwtacacs scheme to create an HWTACACS scheme and enter its view, or enter the view of an existing HWTACACS scheme.
Use undo hwtacacs scheme to delete an HWTACACS scheme.
Syntax
hwtacacs scheme hwtacacs-scheme-name
undo hwtacacs scheme hwtacacs-scheme-name
Default
No HWTACACS schemes exist.
Views
System view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme-name: Specifies the HWTACACS scheme name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
An HWTACACS scheme can be used by more than one ISP domain at the same time.
You can configure a maximum of 16 HWTACACS schemes.
Examples
# Create an HWTACACS scheme named hwt1 and enter HWTACACS scheme view.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1]
Related commands
display hwtacacs scheme
key (HWTACACS scheme view)
Use key to set the shared key for secure HWTACACS authentication, authorization, or accounting communication.
Use undo key to delete the shared key for secure HWTACACS authentication, authorization, or accounting communication.
Syntax
key { accounting | authentication | authorization } { cipher | simple } string
undo key { accounting | authentication | authorization }
Default
No shared key is configured for secure HWTACACS authentication, authorization, or accounting communication.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
accounting: Specifies the shared key for secure HWTACACS accounting communication.
authentication: Specifies the shared key for secure HWTACACS authentication communication.
authorization: Specifies the shared key for secure HWTACACS authorization communication.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the password is a string of 1 to 255 characters.
Usage guidelines
The shared keys configured on the device must match those configured on the HWTACACS servers.
Examples
# In HWTACACS scheme hwt1, set the shared key to 123456TESTauth&! in plaintext form for secure HWTACACS authentication communication.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] key authentication simple 123456TESTauth&!
# Set the shared key to 123456TESTautr&! in plaintext form for secure HWTACACS authorization communication.
[Sysname-hwtacacs-hwt1] key authorization simple 123456TESTautr&!
# Set the shared key to 123456TESTacct&! in plaintext form for secure HWTACACS accounting communication.
[Sysname-hwtacacs-hwt1] key accounting simple 123456TESTacct&!
Related commands
display hwtacacs scheme
nas-ip (HWTACACS scheme view)
Use nas-ip to specify a source IP address for outgoing HWTACACS packets.
Use undo nas-ip to delete the source IP address of the specified type for outgoing HWTACACS packets.
Syntax
nas-ip { ipv4-address | ipv6 ipv6-address }
undo nas-ip [ ipv6 ]
Default
The source IP address of an outgoing HWTACACS packet is that configured by using the hwtacacs nas-ip command in system view.
If the hwtacacs nas-ip command is not configured, the source IP address is the primary IP address of the outbound interface.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies an IPv4 address, which must be an address of the device. The IP address cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address.
ipv6 ipv6-address: Specifies an IPv6 address, which must be a unicast address of the device and cannot be a loopback address or a link-local address.
Usage guidelines
The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS that is configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon receiving an HWTACACS packet, the HWTACACS server checks the source IP address of the packet.
· If the source IP address belongs to a managed NAS, the server processes the packet.
· If the source IP address does not belong to a managed NAS, the server drops the packet.
As a best practice to avoid HWTACACS packet loss caused by physical port errors, specify a loopback interface address as the source IP address of outgoing HWTACACS packets.
If you use both the nas-ip command and hwtacacs nas-ip command, the following guidelines apply:
· The setting configured by using the nas-ip command in HWTACACS scheme view applies only to the HWTACACS scheme.
· The setting configured by using the hwtacacs nas-ip command in system view applies to all HWTACACS schemes.
· The setting in HWTACACS scheme view takes precedence over the setting in system view.
You can specify only one source IPv4 address and one source IPv6 address for an HWTACACS scheme.
If you do not specify the ipv6 keyword for the undo nas-ip command, the command deletes the configured source IPv4 address for outgoing HWTACACS packets.
Examples
# In HWTACACS scheme hwt1, specify IP address 10.1.1.1 as the source address of outgoing HWTACACS packets.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] nas-ip 10.1.1.1
Related commands
hwtacacs nas-ip
primary accounting (HWTACACS scheme view)
Use primary accounting to specify the primary HWTACACS accounting server.
Use undo primary accounting to restore the default.
Syntax
primary accounting { ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *
undo primary accounting
Default
The primary HWTACACS accounting server is not specified.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies an IPv4 address of the primary HWTACACS accounting server.
ipv6 ipv6-address: Specifies an IPv6 address of the primary HWTACACS accounting server.
port-number: Specifies the service port number of the primary HWTACACS accounting server. The value range for the TCP port number is 1 to 65535. The default setting is 49.
key: Specifies the shared key for secure communication with the primary HWTACACS accounting server.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the key is a string of 1 to 255 characters.
single-connection: The device and the primary HWTACACS accounting server use the same TCP connection to exchange accounting packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges accounting packets with the primary accounting server for a user.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the primary HWTACACS accounting server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Usage guidelines
Make sure the port number and shared key settings of the primary HWTACACS accounting server are the same as those configured on the server.
Two accounting servers specified for a scheme, primary or secondary, cannot have identical IP address, VPN instance, port number settings.
As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.
If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.
You can remove an accounting server only when it is not used for user accounting. Removing an accounting server affects only accounting processes that occur after the remove operation.
Examples
# In HWTACACS scheme hwt1, specify the primary accounting server with IP address 10.163.155.12, TCP port number 49, and plaintext shared key 123456TESTacct&!.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] primary accounting 10.163.155.12 49 key simple 123456TESTacct&!
Related commands
display hwtacacs scheme
key (HWTACACS scheme view)
secondary accounting (HWTACACS scheme view)
vpn-instance (HWTACACS scheme view)
primary authentication (HWTACACS scheme view)
Use primary authentication to specify the primary HWTACACS authentication server.
Use undo primary authentication to restore the default.
Syntax
primary authentication { ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *
undo primary authentication
Default
The primary HWTACACS authentication server is not specified.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies the IPv4 address of the primary HWTACACS authentication server.
ipv6 ipv6-address: Specifies the IPv6 address of the primary HWTACACS authentication server.
port-number: Specifies the service port number of the primary HWTACACS authentication server. The value range for the TCP port number is 1 to 65535. The default setting is 49.
key: Specifies the shared key for secure communication with the primary HWTACACS authentication server.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the password is a string of 1 to 255 characters.
single-connection: The device and the primary HWTACACS authentication server use the same TCP connection to exchange all authentication packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges authentication packets with the primary authentication server for a user.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the primary HWTACACS authentication server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Usage guidelines
Make sure the port number and shared key settings of the primary HWTACACS authentication server are the same as those configured on the server.
Two authentication servers specified for a scheme, primary or secondary, cannot have identical IP address, VPN instance, and port number settings.
As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.
If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.
You can remove an authentication server only when it is not used for user authentication. Removing an authentication server affects only authentication processes that occur after the remove operation.
Examples
# In HWTACACS scheme hwt1, specify the primary authentication server with IP address 10.163.155.13, TCP port number 49, and plaintext shared key 123456TESTauth&!.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] primary authentication 10.163.155.13 49 key simple 123456TESTauth&!
Related commands
display hwtacacs scheme
key (HWTACACS scheme view)
secondary authentication (HWTACACS scheme view)
vpn-instance (HWTACACS scheme view)
primary authorization
Use primary authorization to specify the primary HWTACACS authorization server.
Use undo primary authorization to restore the default.
Syntax
primary authorization { ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *
undo primary authorization
Default
The primary HWTACACS authorization server is not specified.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies the IPv4 address of the primary HWTACACS authorization server.
ipv6 ipv6-address: Specifies the IPv6 address of the primary HWTACACS authorization server.
port-number: Specifies the service port number of the primary HWTACACS authorization server. The value range for the TCP port number is 1 to 65535. The default setting is 49.
key: Specifies the shared key for secure communication with the primary HWTACACS authorization server.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the password is a string of 1 to 255 characters.
single-connection: The device and the primary HWTACACS authorization server use the same TCP connection to exchange all authorization packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges authorization packets with the primary authorization server for a user.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the primary HWTACACS authorization server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Usage guidelines
Make sure the port number and shared key settings of the primary HWTACACS authorization server are the same as those configured on the server.
Two authorization servers specified for a scheme, primary or secondary, cannot have identical IP address, VPN instance, and port number settings.
As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.
If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.
You can remove an authorization server only when it is not used for user authorization. Removing an authorization server affects only authorization processes that occur after the remove operation.
Examples
# In HWTACACS scheme hwt1, specify the primary authorization server with IP address 10.163.155.13, TCP port number 49, and plaintext shared key 123456TESTautr&!.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] primary authorization 10.163.155.13 49 key simple 123456TESTautr&!
Related commands
display hwtacacs scheme
key (HWTACACS scheme view)
secondary authorization (HWTACACS scheme view)
vpn-instance (HWTACACS scheme view)
reset hwtacacs statistics
Use reset hwtacacs statistics to clear HWTACACS statistics.
Syntax
reset hwtacacs statistics { accounting | all | authentication | authorization }
Views
User view
Predefined user roles
network-admin
Parameters
accounting: Clears the HWTACACS accounting statistics.
all: Clears all HWTACACS statistics.
authentication: Clears the HWTACACS authentication statistics.
authorization: Clears the HWTACACS authorization statistics.
Examples
# Clear all HWTACACS statistics.
<Sysname> reset hwtacacs statistics all
Related commands
display hwtacacs scheme
reset stop-accounting-buffer (for HWTACACS)
Use reset stop-accounting-buffer to clear buffered HWTACACS stop-accounting requests to which no responses have been received.
Syntax
reset stop-accounting-buffer hwtacacs-scheme hwtacacs-scheme-name
Views
User view
Predefined user roles
network-admin
Parameters
hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.
Examples
# Clear nonresponded stop-accounting requests buffered for HWTACACS scheme hwt1.
<Sysname> reset stop-accounting-buffer hwtacacs-scheme hwt1
Related commands
display stop-accounting-buffer (for HWTACACS)
stop-accounting-buffer enable (HWTACACS scheme view)
retry stop-accounting (HWTACACS scheme view)
Use retry stop-accounting to set the maximum number of transmission attempts for individual HWTACACS stop-accounting requests.
Use undo retry stop-accounting to restore the default.
Syntax
retry stop-accounting retries
undo retry stop-accounting
Default
The maximum number of transmission attempts for individual HWTACACS stop-accounting requests is 100.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
retries: Specifies the maximum number of transmission attempts for HWTACACS stop-accounting requests. The value range is 1 to 300.
Examples
# In HWTACACS scheme hwt1, set the maximum number of HWTACACS stop-accounting attempts to 300.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] retry stop-accounting 300
Related commands
display stop-accounting-buffer (for HWTACACS)
timer response-timeout (HWTACACS scheme view)
secondary accounting (HWTACACS scheme view)
Use secondary accounting to specify a secondary HWTACACS accounting server.
Use undo secondary accounting to remove a secondary HWTACACS accounting server.
Syntax
secondary accounting { ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *
undo secondary accounting [ { ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ]
Default
No secondary HWTACACS accounting servers are specified.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies the IPv4 address of the secondary HWTACACS accounting server.
ipv6 ipv6-address: Specifies the IPv6 address of the secondary HWTACACS accounting server.
port-number: Specifies the service port number of the secondary HWTACACS accounting server. The value range for the TCP port number is 1 to 65535. The default setting is 49.
key: Specifies the shared key for secure communication with the secondary HWTACACS accounting server.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the password is a string of 1 to 255 characters.
single-connection: The device and the secondary HWTACACS accounting server use the same TCP connection to exchange all accounting packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges accounting packets with the secondary accounting server for a user.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary HWTACACS accounting server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Usage guidelines
Make sure the port number and shared key settings of the secondary HWTACACS accounting server are the same as those configured on the server.
An HWTACACS scheme supports a maximum of 16 secondary HWTACACS accounting servers. If the primary server fails, the device tries to communicate with a secondary server in active state. The device connects to the secondary servers in the order they are configured.
If you do not specify any parameters for the undo secondary accounting command, the command removes all secondary accounting servers.
Two accounting servers specified for a scheme, primary or secondary, cannot have identical IP address, VPN instance, and port number settings.
As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.
If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.
You can remove an accounting server only when it is not used for user accounting. Removing an accounting server affects only accounting processes that occur after the remove operation.
Examples
# In HWTACACS scheme hwt1, specify a secondary accounting server with IP address 10.163.155.12, TCP port number 49, and plaintext shared key 123456TESTacct&!.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] secondary accounting 10.163.155.12 49 key simple 123456TESTacct&!
Related commands
display hwtacacs scheme
key (HWTACACS scheme view)
primary accounting (HWTACACS scheme view)
vpn-instance (HWTACACS scheme view)
secondary authentication (HWTACACS scheme view)
Use secondary authentication to specify a secondary HWTACACS authentication server.
Use undo secondary authentication to remove a secondary HWTACACS authentication server.
Syntax
secondary authentication { ipv4-address | ipv6 ipv6-address } [ port-number I key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *
undo secondary authentication [ { ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ]
Default
No secondary HWTACACS authentication servers are specified.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies the IPv4 address of the secondary HWTACACS authentication server.
ipv6 ipv6-address: Specifies the IPv6 address of the secondary HWTACACS authentication server.
port-number: Specifies the service port number of the secondary HWTACACS authentication server. The value range for the TCP port number is 1 to 65535. The default setting is 49.
key: Specifies the shared key for secure communication with the secondary HWTACACS authentication server.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the password is a string of 1 to 255 characters.
single-connection: The device and the secondary HWTACACS authentication server use the same TCP connection to exchange all authentication packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges authentication packets with the secondary authentication server for a user.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary HWTACACS authentication server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Usage guidelines
Make sure the port number and shared key settings of each secondary HWTACACS authentication server are the same as those configured on the corresponding server.
An HWTACACS scheme supports a maximum of 16 secondary HWTACACS authentication servers. If the primary server fails, the device tries to communicate with a secondary server in active state. The device connects to the secondary servers in the order they are configured.
If you do not specify any parameters for the undo secondary authentication command, the command removes all secondary authentication servers.
Two authentication servers specified for a scheme, primary or secondary, cannot have identical IP address, VPN instance, and port number settings.
As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.
If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.
You can remove an authentication server only when it is not used for user authentication. Removing an authentication server affects only authentication processes that occur after the remove operation.
Examples
# In HWTACACS scheme hwt1, specify a secondary authentication server with IP address 10.163.155.13, TCP port number 49, and plaintext shared key 123456TESTauth&!.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] secondary authentication 10.163.155.13 49 key simple 123456TESTauth&!
Related commands
display hwtacacs scheme
key (HWTACACS scheme view)
primary authentication (HWTACACS scheme view)
vpn-instance (HWTACACS scheme view)
secondary authorization
Use secondary authorization to specify a secondary HWTACACS authorization server.
Use undo secondary authorization to remove a secondary HWTACACS authorization server.
Syntax
secondary authorization { ipv4-address | ipv6 ipv6-address } [ port-number I key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *
undo secondary authorization [ { ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ]
Default
No secondary HWTACACS authorization servers are specified.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
ipv4-address: Specifies the IPv4 address of the secondary HWTACACS authorization server.
ipv6 ipv6-address: Specifies the IPv6 address of the secondary HWTACACS authorization server.
port-number: Specifies the service port number of the secondary HWTACACS authorization server. The value range for the TCP port number is 1 to 65535. The default setting is 49.
key: Specifies the shared key for secure communication with the secondary HWTACACS authorization server.
cipher: Specifies the key in encrypted form.
simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.
string: Specifies the key. This argument is case sensitive. The encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the password is a string of 1 to 255 characters.
single-connection: The device and the secondary HWTACACS authorization server use the same TCP connection to exchange all authorization packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges authorization packets with the secondary authorization server for a user.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary HWTACACS authorization server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Usage guidelines
Make sure the port number and shared key settings of the secondary HWTACACS authorization server are the same as those configured on the server.
An HWTACACS scheme supports a maximum of 16 secondary HWTACACS authorization servers. If the primary server fails, the device tries to communicate with a secondary server in active state. The device connects to the secondary servers in the order they are configured.
If you do not specify any parameters for the undo secondary authorization command, the command removes all secondary authorization servers.
Two authorization servers specified for a scheme, primary or secondary, cannot have identical IP address, VPN instance, and port number settings.
As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.
If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.
You can remove an authorization server only when it is not used for user authorization. Removing an authorization server affects only authorization processes that occur after the remove operation.
Examples
# In HWTACACS scheme hwt1, specify a secondary authorization server with IP address 10.163.155.13, TCP port number 49, and plaintext shared key 123456TESTautr&!.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] secondary authorization 10.163.155.13 49 key simple 123456TESTautr&!
Related commands
display hwtacacs scheme
key (HWTACACS scheme view)
primary authorization (HWTACACS scheme view)
vpn-instance (HWTACACS scheme view)
stop-accounting-buffer enable (HWTACACS scheme view)
Use stop-accounting-buffer enable to enable buffering of HWTACACS stop-accounting requests to which no responses have been received.
Use undo stop-accounting-buffer enable to disable buffering of HWTACACS stop-accounting requests to which no responses have been received.
Syntax
stop-accounting-buffer enable
undo stop-accounting-buffer enable
Default
The device buffers HWTACACS stop-accounting requests to which no responses have been received.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Usage guidelines
This command enables the device to buffer an HWTACACS stop-accounting request to which no response has been received. The device resends the buffered request until it receives a server response or when the number of transmission attempts reaches the maximum (set by using the retry stop-accounting command). If no more attempts are available, the device discards the request. However, if you have removed an accounting server, stop-accounting requests destined for the server are not buffered.
Examples
# Enable buffering of HWTACACS stop-accounting requests to which no responses have been received.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] stop-accounting-buffer enable
Related commands
display stop-accounting-buffer (for HWTACACS)
reset stop-accounting-buffer (for HWTACACS)
timer quiet (HWTACACS scheme view)
Use timer quiet to set the quiet timer for the servers specified in an HWTACACS scheme.
Use undo timer quiet to restore the default.
Syntax
timer quiet minutes
undo timer quiet
Default
The server quiet period is 5 minutes.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
minutes: Specifies the server quiet period in minutes, in the range of 1 to 255.
Examples
# In HWTACACS scheme hwt1, set the server quiet timer to 10 minutes.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] timer quiet 10
Related commands
display hwtacacs scheme
timer realtime-accounting (HWTACACS scheme view)
Use timer realtime-accounting to set the real-time accounting interval.
Use undo timer realtime-accounting to restore the default.
Syntax
timer realtime-accounting minutes
undo timer realtime-accounting
Default
The real-time accounting interval is 12 minutes.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
minutes: Specifies the real-time accounting interval in minutes, in the range of 0 to 60. Setting this interval to 0 disables the device from sending online user accounting information to the HWTACACS accounting server.
Usage guidelines
For real-time accounting, a NAS must transmit the accounting information of online users to the HWTACACS accounting server periodically. This command is used to set the interval.
A short interval helps improve accounting precision but requires many system resources.
Table 12 Recommended real-time accounting intervals
Number of users |
Real-time accounting interval |
1 to 99 |
3 minutes |
100 to 499 |
6 minutes |
500 to 999 |
12 minutes |
1000 or more |
15 minutes or longer |
When you modify the real-time accounting interval, the following rules apply to users that have been online before the modification:
· If you modify the real-time accounting interval from a non-zero value to zero or from zero to a non-zero value, the modification does not take effect on these users. These users still use the old real-time accounting interval.
· If you modify the real-time accounting interval from a non-zero value to another non-zero value, the modification takes effect immediately on these users.
The device sends a start-accounting packet for a dual-stack user after the user obtains an IP address of one stack. No matter how long the real-time accounting interval is, the device sends an update-accounting packet for the user immediately after the user obtains an IP address of another stack.
Examples
# In HWTACACS scheme hwt1, set the real-time accounting interval to 51 minutes.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] timer realtime-accounting 51
Related commands
display hwtacacs scheme
timer response-timeout (HWTACACS scheme view)
Use timer response-timeout to set the HWTACACS server response timeout timer.
Use undo timer response-timeout to restore the default.
Syntax
timer response-timeout seconds
undo timer response-timeout
Default
The HWTACACS server response timeout time is 5 seconds.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
seconds: Specifies the HWTACACS server response timeout time, in the range of 1 to 300 seconds.
Usage guidelines
HWTACACS is based on TCP. When the server response timeout timer or the TCP timeout timer times out, the device is disconnected from the HWTACACS server.
The client timeout period of the associated access module cannot be shorter than the total response timeout timer of all HWTACACS servers in the scheme. Any violation will result in user logoffs before the authentication, authorization, or accounting process is complete.
Examples
# In HWTACACS scheme hwt1, set the HWTACACS server response timeout timer to 30 seconds.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] timer response-timeout 30
Related commands
display hwtacacs scheme
user-name-format (HWTACACS scheme view)
Use user-name-format to specify the format of the username to be sent to an HWTACACS server.
Use undo user-name-format to restore the default.
Syntax
user-name-format { keep-original | with-domain | without-domain }
undo user-name-format
Default
The ISP domain name is included in the usernames sent to an HWTACACS server.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
keep-original: Sends the username to the HWTACACS server as the username is entered.
with-domain: Includes the ISP domain name in the username sent to the HWTACACS server.
without-domain: Excludes the ISP domain name from the username sent to the HWTACACS server.
Usage guidelines
A username is generally in the userid@isp-name format, of which the isp-name part is used by the device to determine the ISP domain to which a user belongs. However, some HWTACACS servers cannot recognize a username containing an ISP domain name. Before sending a username including a domain name to such an HWTACACS server, the device must remove the domain name. This command allows you to specify whether to include a domain name in a username to be sent to an HWTACACS server.
If an HWTACACS scheme defines that the username is sent without the ISP domain name, do not apply the scheme to more than one ISP domain. Otherwise, the HWTACACS server will consider two users in different ISP domains but with the same userid as one user.
Examples
# In HWTACACS scheme hwt1, configure the device to remove the ISP domain name from the usernames sent to the HWTACACS servers.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] user-name-format without-domain
Related commands
display hwtacacs scheme
vpn-instance (HWTACACS scheme view)
Use vpn-instance to specify an MPLS L3VPN instance for an HWTACACS scheme.
Use undo vpn-instance to restore the default.
Syntax
vpn-instance vpn-instance-name
undo vpn-instance
Default
The HWTACACS scheme belongs to the public network.
Views
HWTACACS scheme view
Predefined user roles
network-admin
Parameters
vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters.
Usage guidelines
The VPN instance specified for an HWTACACS scheme applies to all servers in that scheme. If a VPN instance is also configured for an individual HWTACACS server, the VPN instance specified for the HWTACACS scheme does not take effect on that server.
Examples
# Specify VPN instance test for HWTACACS scheme hwt1.
<Sysname> system-view
[Sysname] hwtacacs scheme hwt1
[Sysname-hwtacacs-hwt1] vpn-instance test
Related commands
display hwtacacs scheme
LDAP commands
attribute-map
Use attribute-map to specify the LDAP attribute map in an LDAP scheme.
Use undo attribute-map to restore the default.
Syntax
attribute-map map-name
undo attribute-map
Default
An LDAP scheme does not use an LDAP attribute map in an LDAP scheme.
Views
LDAP scheme view
Predefined user roles
network-admin
Parameters
map-name: Specifies an LDAP attribute map by its name, a case-insensitive string of 1 to 31 characters.
Usage guidelines
When the LDAP scheme used for authorization contains an LDAP attribute map, the device converts server-assigned LDAP attributes to device-recognizable AAA attributes based on the mapping entries.
You can specify only one LDAP attribute map in an LDAP scheme. If you execute this command multiple times, the most recent configuration takes effect.
If you specify another attribute map or change the mapping entries, the new settings are effective only on the LDAP authorization that occurs after your operation.
Examples
# Specify LDAP attribute map map1 in LDAP scheme test.
<Sysname> system-view
[Sysname] ldap scheme test
[Sysname-ldap-test] attribute-map map1
Related commands
display ldap scheme
ldap attribute-map
authentication-server
Use authentication-server to specify the LDAP authentication server for an LDAP scheme.
Use undo authentication-server to restore the default.
Syntax
authentication-server server-name
undo authentication-server
Default
No LDAP authentication server is specified for an LDAP scheme.
Views
LDAP scheme view
Predefined user roles
network-admin
Parameters
server-name: Specifies the name of an LDAP server, a case-insensitive string of 1 to 64 characters.
Usage guidelines
You can specify only one LDAP authentication server in an LDAP scheme. If you execute this command multiple times, the most recent configuration takes effect.
Examples
# In LDAP scheme ldap1, specify the LDAP authentication server as ccc.
<Sysname> system-view
[Sysname] ldap scheme ldap1
[Sysname-ldap-ldap1] authentication-server ccc
Related commands
display ldap scheme
ldap server
authorization-server
Use authorization-server to specify the LDAP authorization server for an LDAP scheme.
Use undo authorization-server to restore the default.
Syntax
authorization-server server-name
undo authorization-server
Default
No LDAP authorization server is specified for an LDAP scheme.
Views
LDAP scheme view
Predefined user roles
network-admin
Parameters
server-name: Specifies the name of an LDAP server, a case-insensitive string of 1 to 64 characters.
Usage guidelines
You can specify only one LDAP authorization server in an LDAP scheme. If you execute this command multiple times, the most recent configuration takes effect.
Examples
# In LDAP scheme ldap1, specify the LDAP authorization server as ccc.
<Sysname> system-view
[Sysname] ldap scheme ldap1
[Sysname-ldap-ldap1] authorization-server ccc
Related commands
display ldap scheme
ldap server
display ldap scheme
Use display ldap scheme to display LDAP scheme configuration.
Syntax
display ldap scheme [ ldap-scheme-name ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters. If you do not specify an LDAP scheme, this command displays the configuration of all LDAP schemes.
Examples
# Display the configuration of all LDAP schemes.
<Sysname> display ldap scheme
Total 1 LDAP schemes
------------------------------------------------------------------
LDAP scheme name : aaa
Authentication server : aaa
IP : 1.1.1.1
Port : 111
VPN instance : Not configured
LDAP protocol version : LDAPv3
Server timeout interval : 10 seconds
Login account DN : Not configured
Base DN : Not configured
Search scope : all-level
User searching parameters:
User object class : Not configured
Username attribute : cn
Username format : with-domain
Authorization server : aaa
IP : 1.1.1.1
Port : 111
VPN instance : Not configured
LDAP protocol version : LDAPv3
Server timeout interval : 10 seconds
Login account DN : Not configured
Base DN : Not configured
Search scope : all-level
User searching parameters:
User object class : Not configured
Username attribute : cn
Username format : with-domain
Attribute map : map1
------------------------------------------------------------------
Table 13 Command output
Field |
Description |
Authentication server |
Name of the LDAP authentication server. If no server is configured, this field displays Not configured. |
Authorization server |
Name of the LDAP authorization server. If no server is configured, this field displays Not configured. |
IP |
IP address of the LDAP server. If no server is specified, this field displays Not configured. |
Port |
Port number of the server. If no port number is specified, this field displays the default port number. |
VPN instance |
MPLS L3VPN instance to which the LDAP server belongs. If no VPN instance is specified, this field displays Not configured. |
LDAP protocol version |
LDAP version, LDAPv2 or LDAPv3. |
Server timeout interval |
LDAP server timeout period, in seconds. |
Login account DN |
DN of the administrator. |
Base DN |
Base DN for user search. |
Search scope |
User DN search scope, including: · all-level—All subdirectories. · single-level—Next lower level of subdirectories under the base DN. |
User searching parameters |
User search parameters. |
User object class |
User object class for user DN search. If no user object class is configured, this field displays Not configured. |
Username attribute |
User account attribute for login. |
Username format |
Format for the username sent to the server. |
Attribute map |
LDAP attribute map used by the scheme. If no LDAP attribute map is used, this field displays Not configured. |
ip
Use ip to configure the IP address of the LDAP server.
Use undo ip to restore the default.
Syntax
ip ip-address [ port port-number ] [ vpn-instance vpn-instance-name ]
undo ip
Default
An LDAP server does not have an IP address.
Views
LDAP server view
Predefined user roles
network-admin
Parameters
ip-address: Specifies the IP address of the LDAP server.
port port-number: Specifies the TCP port number of the LDAP server. The value range for the port-number argument is 1 to 65535, and the default value is 389.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the LDAP server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Usage guidelines
The LDAP service port configured on the device must be consistent with the service port of the LDAP server.
If you change the IP address and port number of the LDAP server, the change is effective only on the LDAP authentication that occurs after the change.
Examples
# Specify the IP address and port number as 192.168.0.10 and 4300 for LDAP server ccc.
<Sysname> system-view
[Sysname] ldap server ccc
[Sysname-ldap-server-ccc] ip 192.168.0.10 port 4300
Related commands
ldap server
ipv6
Use ipv6 to configure the IPv6 address of the LDAP server.
Use undo ipv6 to restore the default.
Syntax
ipv6 ipv6-address [ port port-number ] [ vpn-instance vpn-instance-name ]
undo ipv6
Default
An LDAP server does not have an IPv6 address.
Views
LDAP server view
Predefined user roles
network-admin
Parameters
ipv6-address: Specifies the IPv6 address of the LDAP server.
port port-number: Specifies the TCP port number of the LDAP server. The value range for the port-number argument is 1 to 65535, and the default value is 389.
vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the LDAP server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.
Usage guidelines
The LDAP service port configured on the device must be consistent with the service port of the LDAP server.
If you change the IP address and port number of the LDAP server, the change is effective only on the LDAP authentication that occurs after the change.
Examples
# Specify the IPv6 address and port number as 1:2::3:4 and 4300 for LDAP server ccc.
<Sysname> system-view
[Sysname] ldap server ccc
[Sysname-ldap-server-ccc] ipv6 1:2::3:4 port 4300
Related commands
ldap server
ldap attribute-map
Use ldap attribute-map to create an LDAP attribute map and enter its view, or enter the view of an existing LDAP attribute map.
Use undo ldap attribute-map to delete an LDAP attribute map.
Syntax
ldap attribute-map map-name
undo ldap attribute-map map-name
Default
No LDAP attribute maps exist.
Views
System view
Predefined user roles
network-admin
Parameters
map-name: Specifies the name of the LDAP attribute map, a case-insensitive string of 1 to 31 characters.
Usage guidelines
Execute this command multiple times to create multiple LDAP attribute maps. You can add multiple mapping entries to an LDAP attribute map. Each entry defines the mapping between an LDAP attribute and an AAA attribute.
Examples
# Create an LDAP attribute map named map1 and enter LDAP attribute map view.
<Sysname> system-view
[Sysname] ldap attribute-map map1
[Sysname-ldap-map-map1]
Related commands
attribute-map
ldap scheme
map
ldap scheme
Use ldap scheme to create an LDAP scheme and enter its view, or enter the view of an existing LDAP scheme.
Use undo ldap scheme to delete an LDAP scheme.
Syntax
ldap scheme ldap-scheme-name
undo ldap scheme ldap-scheme-name
Default
No LDAP schemes exist.
Views
System view
Predefined user roles
network-admin
Parameters
ldap-scheme-name: Specifies the LDAP scheme name, a case-insensitive string of 1 to 32 characters.
Usage guidelines
An LDAP scheme can be used by more than one ISP domain at the same time.
You can configure a maximum of 16 LDAP schemes.
Examples
# Create an LDAP scheme named ldap1 and enter LDAP scheme view.
<Sysname> system-view
[Sysname] ldap scheme ldap1
[Sysname-ldap-ldap1]
Related commands
display ldap scheme
ldap server
Use ldap server to create an LDAP server and enter its view, or enter the view of an existing LDAP server.
Use undo ldap server to delete an LDAP server.
Syntax
ldap server server-name
undo ldap server server-name
Default
No LDAP servers exist.
Views
System view
Predefined user roles
network-admin
Parameters
server-name: Specifies the LDAP server name, a case-insensitive string of 1 to 64 characters.
Examples
# Create an LDAP server named ccc and enter LDAP server view.
<Sysname> system-view
[Sysname] ldap server ccc
[Sysname-ldap-server-ccc]
Related commands
display ldap scheme
login-dn
Use login-dn to specify the administrator DN.
Use undo login-dn to restore the default.
Syntax
login-dn dn-string
undo login-dn
Default
No administrator DN is specified.
Views
LDAP server view
Predefined user roles
network-admin
Parameters
dn-string: Specifies the administrator DN for binding with the server, a case-insensitive string of 1 to 255 characters.
Usage guidelines
The administrator DN specified on the device must be consistent with the administrator DN configured on the LDAP server.
If you change the administrator DN, the change is effective only on the LDAP authentication that occurs after the change.
Examples
# Specify the administrator DN as uid=test, ou=people, o=example, c=city for LDAP server ccc.
<Sysname> system-view
[Sysname] ldap server ccc
[Sysname-ldap-server-ccc] login-dn uid=test,ou=people,o=example,c=city
Related commands
display ldap scheme
login-password
Use login-password to configure the administrator password for binding with the LDAP server during LDAP authentication.
Use undo login-password to restore the default.
Syntax
login-password { cipher | simple } string
undo login-password
Default
No administrator password is configured.
Views
LDAP server view
Predefined user roles
network-admin
Parameters
cipher: Specifies a password in encrypted form.
simple: Specifies a password in plaintext form. For security purposes, the password specified in plaintext form will be stored in encrypted form.
string: Specifies the password. Its plaintext form is a case-sensitive string of 1 to 128 characters. Its encrypted form is a case-sensitive string of 1 to 201 characters.
Usage guidelines
This command is effective only after the login-dn command is configured.
Examples
# Specify the administrator password as abcdefg in plaintext form for LDAP server ccc.
<Sysname> system-view
[Sysname] ldap server ccc
[Sysname-ldap-server-ccc] login-password simple abcdefg
Related commands
display ldap scheme
login-dn
map
Use map to configure a mapping entry in an LDAP attribute map.
Use undo map to delete the specified mapping entries from the LDAP attribute map.
Syntax
map ldap-attribute ldap-attribute-name [ prefix prefix-value delimiter delimiter-value ] aaa-attribute user-group
undo map [ ldap-attribute ldap-attribute-name ]
Default
An LDAP attribute map does not contain mapping entries.
Views
LDAP attribute map view
Predefined user roles
network-admin
Parameters
ldap-attribute ldap-attribute-name: Specifies an LDAP attribute by its name. The ldap-attribute-name argument is a case-insensitive string of 1 to 63 characters.
prefix prefix-value delimiter delimiter-value: Specifies a partial value string of the LDAP attribute for attribute mapping. The prefix-value argument represents the position where the partial string starts. The prefix is a case-insensitive string of 1 to 7 characters, such as cn=. The delimiter-value argument represents the position where the partial string ends, such as a comma (,). If you do not specify the prefix prefix-value delimiter delimiter-value option, the mapping entry uses the entire value string of the LDAP attribute.
aaa-attribute: Specifies an AAA attribute.
user-group: Specifies the user group attribute.
Usage guidelines
Because the device ignores unrecognized LDAP attributes, configure the mapping entries to include important LDAP attributes that should not be ignored.
An LDAP attribute can be mapped only to one AAA attribute. Different LDAP attributes can be mapped to the same AAA attribute.
If you do not specify an LDAP attribute for the undo map command, the command deletes all mapping entries from the LDAP attribute map.
Examples
# In LDAP attribute map map1, map a partial value string of the LDAP attribute named memberof to AAA attribute named user-group.
<Sysname> system-view
[Sysname] ldap attribute-map map1
[Sysname-ldap-map-map1] map ldap-attribute memberof prefix cn= delimiter , aaa-attribute user-group
Related commands
ldap attribute-map
user-group
protocol-version
Use protocol-version to specify the LDAP version.
Use undo protocol-version to restore the default.
Syntax
protocol-version { v2 | v3 }
undo protocol-version
Default
The LDAP version is LDAPv3.
Views
LDAP server view
Predefined user roles
network-admin
Parameters
v2: Specifies the LDAP version LDAPv2.
v3: Specifies the LDAP version LDAPv3.
Usage guidelines
For successful LDAP authentication, the LDAP version used by the device must be consistent with the version used by the LDAP server.
If you change the LDAP version, the change is effective only on the LDAP authentication that occurs after the change.
A Microsoft LDAP server supports only LDAPv3.
Examples
# Specify the LDAP version as LDAPv2 for LDAP server ccc.
<Sysname> system-view
[Sysname] ldap server ccc
[Sysname-ldap-server-ccc] protocol-version v2
Related commands
display ldap scheme
search-base-dn
Use search-base-dn to specify the base DN for user search.
Use undo search-base-dn to restore the default.
Syntax
search-base-dn base-dn
undo search-base-dn
Default
No base DN is specified for user search.
Views
LDAP server view
Predefined user roles
network-admin
Parameters
base-dn: Specifies the base DN for user search, a case-insensitive string of 1 to 255 characters.
Examples
# Specify the base DN for user search as dc=ldap,dc=com for LDAP server ccc.
<Sysname> system-view
[Sysname] ldap server ccc
[Sysname-ldap-server-ccc] search-base-dn dc=ldap,dc=com
Related commands
display ldap scheme
ldap server
search-scope
Use search-scope to specify the user search scope.
Use undo search-scope to restore the default.
Syntax
search-scope { all-level | single-level }
undo search-scope
Default
The user search scope is all-level.
Views
LDAP server view
Predefined user roles
network-admin
Parameters
all-level: Specifies that the search goes through all subdirectories of the base DN.
single-level: Specifies that the search goes through only the next lower level of subdirectories under the base DN.
Examples
# Specify the search scope for the LDAP authentication as all subdirectories of the base DN for LDAP server ccc.
<Sysname> system-view
[Sysname] ldap server ccc
[Sysname-ldap-server-ccc] search-scope all-level
Related commands
display ldap scheme
ldap server
server-timeout
Use server-timeout to set the LDAP server timeout period, the maximum time that the device waits for an LDAP response.
Use undo server-timeout to restore the default.
Syntax
server-timeout time-interval
undo server-timeout
Default
The LDAP server timeout period is 10 seconds.
Views
LDAP server view
Predefined user roles
network-admin
Parameters
time-interval: Specifies the LDAP server timeout period in the range of 5 to 20 seconds.
Usage guidelines
If you change the LDAP server timeout period, the change is effective only on the LDAP authentication that occurs after the change.
Examples
# Set the LDAP server timeout period to 15 seconds for LDAP server ccc.
<Sysname> system-view
[Sysname] ldap server ccc
[Sysname-ldap-server-ccc] server-timeout 15
Related commands
display ldap scheme
user-parameters
Use user-parameters to configure LDAP user attributes, including the username attribute, username format, and user-defined user object class.
Use undo user-parameters to restore the default of an LDAP user attribute.
Syntax
user-parameters { user-name-attribute { name-attribute | cn | uid } | user-name-format { with-domain | without-domain } | user-object-class object-class-name }
undo user-parameters { user-name-attribute | user-name-format | user-object-class }
Default
The LDAP username attribute is cn and the username format is without-domain. No user object class is specified and the default user object class of the LDAP server is used.
Views
LDAP server view
Predefined user roles
network-admin
Parameters
user-name-attribute { name-attribute | cn | uid }: Specifies the username attribute. The name-attribute argument represents an attribute value, a case-insensitive string of 1 to 64 characters. The cn keyword represents the user account attribute of common name, and the uid keyword represents the user account attribute of user ID.
user-name-format { with-domain | without-domain }: Specifies the format of the username to be sent to the server. The with-domain keyword means that the username contains the domain name, and the without-domain keyword means that the username does not contain the domain name.
user-object-class object-class-name: Specifies the user object class for user search. The object-class-name argument represents a class value, a case-insensitive string of 1 to 64 characters.
Usage guidelines
If the username on the LDAP server does not contain the domain name, specify the without-domain keyword. If the username contains the domain name, specify the with-domain keyword.
Examples
# Set the user object class to person for LDAP server ccc.
<Sysname> system-view
[Sysname] ldap server ccc
[Sysname-ldap-server-ccc] user-parameters user-object-class person
Related commands
display ldap scheme
login-dn