09-Security Command Reference

HomeSupportReference GuidesCommand ReferencesH3C S6520X-HI[EI][SI] & S6520-SI & S5560X-HI & S5000-EI & MS4600 Switch Series Command References-R63xx-6W10109-Security Command Reference
01-AAA commands
Title Size Download
01-AAA commands 793.31 KB

Contents

AAA commands· 1

General AAA commands· 1

aaa nas-id profile· 1

aaa session-limit 2

accounting command· 2

accounting default 3

accounting lan-access· 4

accounting login· 6

accounting portal 7

accounting quota-out 9

accounting start-fail 9

accounting update-fail 10

authentication default 11

authentication lan-access· 12

authentication login· 13

authentication portal 15

authentication super 16

authorization command· 17

authorization default 18

authorization lan-access· 19

authorization login· 20

authorization portal 22

authorization-attribute (ISP domain view) 23

display domain· 25

domain· 28

domain default enable· 29

domain if-unknown· 30

local-server log change-password-prompt 31

nas-id bind vlan· 32

session-time include-idle-time· 33

state (ISP domain view) 33

Local user commands· 34

access-limit 34

authorization-attribute (local user view/user group view) 35

bind-attribute· 37

description· 38

display local-user 39

display user-group· 42

group· 43

local-user 44

local-user auto-delete enable· 45

password (device management user view) 46

password (network access user view) 47

service-type· 48

state (local user view) 49

user-group· 49

validity-datetime· 50

RADIUS commands· 51

aaa device-id· 51

accounting-on enable· 52

accounting-on extended· 53

attribute 15 check-mode· 54

attribute 25 car 54

attribute 31 mac-format 55

attribute convert (RADIUS DAS view) 56

attribute convert (RADIUS scheme view) 57

attribute reject (RADIUS DAS view) 58

attribute reject (RADIUS scheme view) 59

attribute remanent-volume· 60

attribute translate· 61

ca-file· 62

client 62

data-flow-format (RADIUS scheme view) 63

display radius scheme· 64

display radius server-load statistics· 68

display radius statistics· 69

display stop-accounting-buffer (for RADIUS) 71

eap-profile· 72

exclude· 72

include· 73

key (RADIUS scheme view) 75

method· 76

nas-ip (RADIUS scheme view) 77

port 78

primary accounting (RADIUS scheme view) 79

primary authentication (RADIUS scheme view) 81

radius attribute extended· 82

radius attribute-test-group· 84

radius dscp· 84

radius dynamic-author server 85

radius enable· 86

radius nas-ip· 87

radius scheme· 88

radius session-control client 89

radius session-control enable· 90

radius trap-version· 91

radius-server test-profile· 92

reauthentication server-select 94

reset radius server-load statistics· 94

reset radius statistics· 95

reset stop-accounting-buffer (for RADIUS) 95

retry· 96

retry realtime-accounting· 97

retry stop-accounting (RADIUS scheme view) 98

secondary accounting (RADIUS scheme view) 99

secondary authentication (RADIUS scheme view) 101

server-load-sharing enable· 103

snmp-agent trap enable radius· 104

state primary· 105

state secondary· 106

stop-accounting-buffer enable (RADIUS scheme view) 107

stop-accounting-packet send-force· 108

test-aaa· 109

timer quiet (RADIUS scheme view) 112

timer realtime-accounting (RADIUS scheme view) 113

timer response-timeout (RADIUS scheme view) 114

user-name-format (RADIUS scheme view) 115

vpn-instance (RADIUS scheme view) 116

HWTACACS commands· 117

data-flow-format (HWTACACS scheme view) 117

display hwtacacs scheme· 118

display stop-accounting-buffer (for HWTACACS) 123

hwtacacs nas-ip· 123

hwtacacs scheme· 125

key (HWTACACS scheme view) 126

nas-ip (HWTACACS scheme view) 127

primary accounting (HWTACACS scheme view) 128

primary authentication (HWTACACS scheme view) 129

primary authorization· 131

reset hwtacacs statistics· 132

reset stop-accounting-buffer (for HWTACACS) 133

retry stop-accounting (HWTACACS scheme view) 133

secondary accounting (HWTACACS scheme view) 134

secondary authentication (HWTACACS scheme view) 136

secondary authorization· 137

stop-accounting-buffer enable (HWTACACS scheme view) 139

timer quiet (HWTACACS scheme view) 140

timer realtime-accounting (HWTACACS scheme view) 140

timer response-timeout (HWTACACS scheme view) 141

user-name-format (HWTACACS scheme view) 142

vpn-instance (HWTACACS scheme view) 143

LDAP commands· 144

attribute-map· 144

authentication-server 145

authorization-server 145

display ldap scheme· 146

ip· 148

ipv6· 149

ldap attribute-map· 149

ldap scheme· 150

ldap server 151

login-dn· 151

login-password· 152

map· 153

protocol-version· 154

search-base-dn· 155

search-scope· 155

server-timeout 156

user-parameters· 157

RADIUS server commands· 158

display radius-server active-client 158

display radius-server active-user 158

radius-server activate· 160

radius-server client 160

Connection recording policy commands· 161

aaa connection-recording policy· 161

accounting hwtacacs-scheme· 162

display aaa connection-recording policy· 163


AAA commands

The device supports the FIPS mode that complies with NIST FIPS 140-2 requirements. Support for features, commands, and parameters might differ in FIPS mode and non-FIPS mode. For more information about FIPS mode, see Security Configuration Guide.

General AAA commands

aaa nas-id profile

Use aaa nas-id profile to create a NAS-ID profile and enter its view, or enter the view of an existing NAS-ID profile.

Use undo aaa nas-id profile to delete a NAS-ID profile.

Syntax

aaa nas-id profile profile-name

undo aaa nas-id profile profile-name

Default

No NAS-ID profiles exist.

Views

System view

Predefined user roles

network-admin

Parameters

profile-name: Specifies the NAS-ID profile name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

Configure a NAS-ID profile to maintain NAS-ID and VLAN bindings on the device.

During RADIUS authentication, the device uses a NAS-ID to set the NAS-Identifier attribute of RADIUS packets so that the RADIUS server can identify the access location of users.

By default, the device uses the device name as the NAS-ID.

Examples

# Create a NAS-ID profile named aaa and enter its view.

<Sysname> system-view

[Sysname] aaa nas-id profile aaa

[Sysname-nas-id-prof-aaa]

Related commands

nas-id bind vlan

port-security nas-id-profile

portal nas-id-profile

aaa session-limit

Use aaa session-limit to set the maximum number of concurrent users that can log on to the device through the specified method.

Use undo aaa session-limit to restore the default maximum number of concurrent users for the specified login method.

Syntax

In non-FIPS mode:

aaa session-limit { ftp | http | https | ssh | telnet } max-sessions

undo aaa session-limit { ftp | http | https | ssh | telnet }

In FIPS mode:

aaa session-limit { https | ssh } max-sessions

undo aaa session-limit { https | ssh }

Default

The maximum number of concurrent users is 32 for each user type.

Views

System view

Predefined user roles

network-admin

Parameters

ftp: FTP users.

http: HTTP users.

https: HTTPS users.

ssh: SSH users.

telnet: Telnet users.

max-sessions: Specifies the maximum number of concurrent login users. The value range is 1 to 32 for FTP, SSH, and Telnet services, and is 1 to 64 for HTTP and HTTPS services.

Usage guidelines

After the maximum number of concurrent login users for a user type exceeds the upper limit, the system denies the subsequent users of this type.

Examples

# Set the maximum number of concurrent FTP users to 4.

<Sysname> system-view

[Sysname] aaa session-limit ftp 4

accounting command

Use accounting command to specify the command line accounting method.

Use undo accounting command to restore the default.

Syntax

accounting command hwtacacs-scheme hwtacacs-scheme-name

undo accounting command

Default

The default accounting methods of the ISP domain are used for command line accounting.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The command line accounting feature works with the accounting server to record valid commands that have been successfully executed on the device.

·     When the command line authorization feature is disabled, the accounting server records all valid commands that have been successfully executed.

·     When the command line authorization feature is enabled, the accounting server records only authorized commands that have been successfully executed.

Command line accounting can use only a remote HWTACACS server.

Examples

# In ISP domain test, perform command line accounting based on HWTACACS scheme hwtac.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting command hwtacacs-scheme hwtac

Related commands

accounting default

command accounting (Fundamentals Command Reference)

hwtacacs scheme

accounting default

Use accounting default to specify default accounting methods for an ISP domain.

Use undo accounting default to restore the default.

Syntax

In non-FIPS mode:

accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo accounting default

In FIPS mode:

accounting default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo accounting default

Default

The default accounting method of an ISP domain is local.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The default accounting method is used for all users that support this method and do not have an accounting method configured.

Local accounting is only used for monitoring and controlling the number of local user connections. It does not provide the statistics function that the accounting feature generally provides.

You can specify one primary default accounting method and multiple backup default accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting default radius-scheme radius-scheme-name local none command specifies the primary default RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when the RADIUS server is invalid. The device does not perform accounting when both of the previous methods are invalid.

Examples

# In ISP domain test, use RADIUS scheme rd as the primary default accounting method and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting default radius-scheme rd local

Related commands

hwtacacs scheme

local-user

radius scheme

accounting lan-access

Use accounting lan-access to specify accounting methods for LAN users.

Use undo accounting lan-access to restore the default.

Syntax

In non-FIPS mode:

accounting lan-access { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo accounting lan-access

In FIPS mode:

accounting lan-access { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ local ] | local | radius-scheme radius-scheme-name [ local ] }

undo accounting lan-access

Default

The default accounting methods of the ISP domain are used for LAN users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

broadcast: Broadcasts accounting requests to servers in RADIUS schemes.

radius-scheme radius-scheme-name1: Specifies the primary broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

radius-scheme radius-scheme-name2: Specifies the backup broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary accounting method and multiple backup accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting lan-access radius-scheme radius-scheme-name local none command specifies a primary RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when the RADIUS server is invalid. The device does not perform accounting when both of the previous methods are invalid.

The following guidelines apply to broadcast accounting:

·     The device sends accounting requests to the primary accounting servers in the specified broadcast RADIUS schemes at the real-time accounting interval set in the primary broadcast RADIUS scheme. If the primary server is unavailable in a scheme, the device sends accounting requests to the secondary servers of the scheme in the order the servers are configured.

·     The accounting result is determined by the primary broadcast RADIUS scheme. The accounting result from the backup scheme is used as reference only. If the primary scheme does not return any result, the device considers the accounting as a failure.

Examples

# In ISP domain test, perform local accounting for LAN users.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting lan-access local

# In ISP domain test, perform RADIUS accounting for LAN users based on scheme rd and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting lan-access radius-scheme rd local

# In ISP domain test, broadcast accounting requests of LAN users to RADIUS servers in schemes rd1 and rd2, and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting lan-access broadcast radius-scheme rd1 radius-scheme rd2 local

Related commands

accounting default

local-user

radius scheme

timer realtime-accounting

accounting login

Use accounting login to specify accounting methods for login users.

Use undo accounting login to restore the default.

Syntax

In non-FIPS mode:

accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo accounting login

In FIPS mode:

accounting login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo accounting login

Default

The default accounting methods of the ISP domain are used for login users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

Accounting is not supported for FTP, SFTP, and SCP users.

You can specify one primary accounting method and multiple backup accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting login radius-scheme radius-scheme-name local none command specifies a primary default RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when the RADIUS server is invalid. The device does not perform accounting when both of the previous methods are invalid.

Examples

# In ISP domain test, perform local accounting for login users.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting login local

# In ISP domain test, perform RADIUS accounting for login users based on scheme rd and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting login radius-scheme rd local

Related commands

accounting default

hwtacacs scheme

local-user

radius scheme

accounting portal

Use accounting portal to specify accounting methods for portal users.

Use undo accounting portal to restore the default.

Syntax

In non-FIPS mode:

accounting portal { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo accounting portal

In FIPS mode:

accounting portal { broadcast radius-scheme radius-scheme-name1 radius-scheme radius-scheme-name2 [ local ] | local | radius-scheme radius-scheme-name [ local ] }

undo accounting portal

Default

The default accounting methods of the ISP domain are used for portal users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

broadcast: Broadcasts accounting requests to servers in RADIUS schemes.

radius-scheme radius-scheme-name1: Specifies the primary broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

radius-scheme radius-scheme-name2: Specifies the backup broadcast RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local accounting.

none: Does not perform accounting.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary accounting method and multiple backup accounting methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the accounting portal radius-scheme radius-scheme-name local none command specifies a primary default RADIUS accounting method and two backup methods (local accounting and no accounting). The device performs RADIUS accounting by default and performs local accounting when the RADIUS server is invalid. The device does not perform accounting when both of the previous methods are invalid.

The following guidelines apply to broadcast accounting:

·     The device sends accounting requests to the primary accounting servers in the specified broadcast RADIUS schemes at the real-time accounting interval set in the primary broadcast RADIUS scheme. If the primary server is unavailable in a scheme, the device sends accounting requests to the secondary servers of the scheme in the order the servers are configured.

·     The accounting result is determined by the primary broadcast RADIUS scheme. The accounting result from the backup scheme is used as reference only. If the primary scheme does not return any result, the device considers the accounting as a failure.

Examples

# In ISP domain test, perform local accounting for portal users.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting portal local

# In ISP domain test, perform RADIUS accounting for portal users based on scheme rd and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting portal radius-scheme rd local

# In ISP domain test, broadcast accounting requests of portal users to RADIUS servers in schemes rd1 and rd2, and use local accounting as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting portal broadcast radius-scheme rd1 radius-scheme rd2 local

Related commands

accounting default

local-user

radius scheme

timer realtime-accounting

accounting quota-out

Use accounting quota-out to configure access control for users that have used up their data or time accounting quotas.

Use undo accounting quota-out to restore the default.

Syntax

accounting quota-out { offline | online }

undo accounting quota-out

Default

The device logs off users that have used up their accounting quotas.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

offline: Logs off users that have used up their accounting quotas.

online: Allows users that have used up their accounting quotas to stay online.

Usage guidelines

If the server notifies the device of portal users' remaining accounting quotas, the time that the device logs out portal users that have used up their accounting quotas might be inaccurate.

Examples

# In ISP domain test, configure the device to allow users that have used up their accounting quotas to stay online.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting quota-out online

accounting start-fail

Use accounting start-fail to configure access control for users that encounter accounting-start failures.

Use undo accounting start-fail to restore the default.

Syntax

accounting start-fail { offline | online }

undo accounting start-fail

Default

The device allows users that encounter accounting-start failures to stay online.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

offline: Logs off users that encounter accounting-start failures.

online: Allows users that encounter accounting-start failures to stay online.

Examples

# In ISP domain test, configure the device to allow users that encounter accounting-start failures to stay online.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting start-fail online

accounting update-fail

Use accounting update-fail to configure access control for users that have failed all their accounting-update attempts.

Use undo accounting update-fail to restore the default.

Syntax

accounting update-fail { [ max-times max-times ] offline | online }

undo accounting update-fail

Default

The device allows users that have failed all their accounting-update attempts to stay online.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

max-times max-times: Specifies the maximum number of consecutive accounting-update failures allowed by the device for each user. The value range for the times argument is 1 to 255, and the default value is 1.

offline: Logs off users that have failed all their accounting-update attempts.

online: Allows users that have failed all their accounting-update attempts to stay online.

Examples

# In ISP domain test, configure the device to allow users that have failed all their accounting-update attempts to stay online.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] accounting update-fail online

authentication default

Use authentication default to specify default authentication methods for an ISP domain.

Use undo authentication default to restore the default.

Syntax

In non-FIPS mode:

authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | ldap-scheme ldap-scheme-name [ local ] [ none ]  | local [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo authentication default

In FIPS mode:

authentication default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | ldap-scheme ldap-scheme-name [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo authentication default

Default

The default authentication method of an ISP domain is local.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The default authentication method is used for all users that support this method and do not have an authentication method configured.

You can specify one primary default authentication method and multiple backup default authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication default radius-scheme radius-scheme-name local none command specifies a primary default RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when the RADIUS server is invalid. The device does not perform authentication when both of the previous methods are invalid.

Examples

# In ISP domain test, use RADIUS scheme rd as the primary default authentication method and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authentication default radius-scheme rd local

Related commands

hwtacacs scheme

ldap scheme

local-user

radius scheme

authentication lan-access

Use authentication lan-access to specify authentication methods for LAN users.

Use undo authentication lan-access to restore the default.

Syntax

In non-FIPS mode:

authentication lan-access { ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authentication lan-access

In FIPS mode:

authentication lan-access { ldap-scheme ldap-scheme-name [ local ] | local | radius-scheme radius-scheme-name [ local ] }

undo authentication lan-access

Default

The default authentication methods of the ISP domain are used for LAN users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication lan-access radius-scheme radius-scheme-name local none command specifies a primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when the RADIUS server is invalid. The device does not perform authentication when both of the previous methods are invalid.

Examples

# In ISP domain test, perform local authentication for LAN users.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authentication lan-access local

# In ISP domain test, perform RADIUS authentication for LAN users based on scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authentication lan-access radius-scheme rd local

Related commands

authentication default

hwtacacs scheme

ldap scheme

local-user

radius scheme

authentication login

Use authentication login to specify authentication methods for login users.

Use undo authentication login to restore the default.

Syntax

In non-FIPS mode:

authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | ldap-scheme ldap-scheme-name [ local ] [ none ]  | local [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo authentication login

In FIPS mode:

authentication login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | ldap-scheme ldap-scheme-name [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo authentication login

Default

The default authentication methods of the ISP domain are used for login users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication login radius-scheme radius-scheme-name local none command specifies the default primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when the RADIUS server is invalid. The device does not perform authentication when both of the previous methods are invalid.

Examples

# In ISP domain test, perform local authentication for login users.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authentication login local

# In ISP domain test, perform RADIUS authentication for login users based on scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authentication login radius-scheme rd local

Related commands

authentication default

hwtacacs scheme

ldap scheme

local-user

radius scheme

authentication portal

Use authentication portal to specify authentication methods for portal users.

Use undo authentication portal to restore the default.

Syntax

In non-FIPS mode:

authentication portal { ldap-scheme ldap-scheme-name [ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authentication portal

In FIPS mode:

authentication portal { ldap-scheme ldap-scheme-name [ local ] | local | radius-scheme radius-scheme-name [ local ] }

undo authentication portal

Default

The default authentication methods of the ISP domain are used for portal users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

ldap-scheme ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authentication.

none: Does not perform authentication.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

You can specify one primary authentication method and multiple backup authentication methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authentication portal radius-scheme radius-scheme-name local none command specifies the default primary RADIUS authentication method and two backup methods (local authentication and no authentication). The device performs RADIUS authentication by default and performs local authentication when the RADIUS server is invalid. The device does not perform authentication when both of the previous methods are invalid.

Examples

# In ISP domain test, perform local authentication for portal users.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authentication portal local

# In ISP domain test, perform RADIUS authentication for portal users based on scheme rd and use local authentication as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authentication portal radius-scheme rd local

Related commands

authentication default

ldap scheme

local-user

radius scheme

authentication super

Use authentication super to specify a method for user role authentication.

Use undo authentication super to restore the default.

Syntax

authentication super { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name } *

undo authentication super

Default

The default authentication methods of the ISP domain are used for user role authentication.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

To enable a user to obtain another user role without reconnecting to the device, you must configure user role authentication. The device supports local and remote methods for user role authentication. For more information about user role authentication, see RBAC configuration in Fundamentals Configuration Guide.

You can specify one authentication method and one backup authentication method to use in case that the previous authentication method is invalid.

Examples

# In ISP domain test, perform user role authentication based on HWTACACS scheme tac.

<Sysname> system-view

[Sysname] super authentication-mode scheme

[Sysname] domain test

[Sysname-isp-test] authentication super hwtacacs-scheme tac

Related commands

authentication default

hwtacacs scheme

radius scheme

authorization command

Use authorization command to specify command authorization methods.

Use undo authorization command to restore the default.

Syntax

In non-FIPS mode:

authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] [ none ] | local [ none ] | none }

undo authorization command

In FIPS mode:

authorization command { hwtacacs-scheme hwtacacs-scheme-name [ local ] | local }

undo authorization command

Default

The default authorization methods of the ISP domain are used for command authorization.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authorization.

none: Does not perform authorization. The authorization server does not verify whether the entered commands are permitted by the user role. The commands are executed successfully if the user role has permission to the commands.

Usage guidelines

Command authorization restricts login users to execute only authorized commands by employing an authorization server to verify whether each entered command is permitted.

When local command authorization is configured, the device compares each entered command with the user's configuration on the device. The command is executed only when it is permitted by the user's authorized user roles.

The commands that can be executed are controlled by both the access permission of user roles and command authorization of the authorization server. Access permission only controls whether the authorized user roles have access to the entered commands, but it does not control whether the user roles have obtained authorization to these commands. If a command is permitted by the access permission but denied by command authorization, this command cannot be executed.

You can specify one primary command authorization method and multiple backup command authorization methods.

When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization command hwtacacs-scheme hwtacacs-scheme-name local none command specifies the default HWTACACS authorization method and two backup methods (local authorization and no authorization). The device performs HWTACACS authorization by default and performs local authorization when the HWTACACS server is invalid. The device does not perform command authorization when both of the previous methods are invalid.

Examples

# In ISP domain test, configure the device to perform local command authorization.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authorization command local

# In ISP domain test, perform command authorization based on HWTACACS scheme hwtac and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authorization command hwtacacs-scheme hwtac local

Related commands

command authorization (Fundamentals Command Reference)

hwtacacs scheme

local-user

authorization default

Use authorization default to specify default authorization methods for an ISP domain.

Use undo authorization default to restore the default.

Syntax

In non-FIPS mode:

authorization default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo authorization default

In FIPS mode:

authorization default { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo authorization default

Default

The default authorization method of an ISP domain is local.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authorization.

none: Does not perform authorization. The following default authorization information applies after users pass authentication:

·     Login users obtain the level-0 user role. Login users include the Telnet, FTP, SFTP, SCP, and terminal users. Terminal users can access the device through the console port. For more information about the level-0 user role, see RBAC configuration in Fundamentals Configuration Guide.

·     The working directory for FTP, SFTP, and SCP login users is the root directory of the NAS. However, the users do not have permission to access the root directory.

·     Non-login users can access the network.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The default authorization method is used for all users that support this method and do not have an authorization method configured.

The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization default radius-scheme radius-scheme-name local none command specifies the default RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when the RADIUS server is invalid. The device does not perform authorization when both of the previous methods are invalid.

Examples

# In ISP domain test, use RADIUS scheme rd as the primary default authorization method and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authorization default radius-scheme rd local

Related commands

hwtacacs scheme

local-user

radius scheme

authorization lan-access

Use authorization lan-access to specify authorization methods for LAN users.

Use undo authorization lan-access to restore the default.

Syntax

In non-FIPS mode:

authorization lan-access { local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authorization lan-access

In FIPS mode:

authorization lan-access { local | radius-scheme radius-scheme-name [ local ] }

undo authorization lan-access

Default

The default authorization methods of the ISP domain are used for LAN users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authorization.

none: Does not perform authorization. An authenticated LAN user directly accesses the network.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The RADIUS authorization configuration takes effect only when authentication and authorization methods of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the primary method is invalid, the device attempts to use the backup methods in sequence. For example, the authorization lan-access radius-scheme radius-scheme-name local none command specifies a primary RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when the RADIUS server is invalid. The device does not perform authorization when both of the previous methods are invalid.

Examples

# In ISP domain test, perform local authorization for LAN users.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authorization lan-access local

# In ISP domain test, perform RADIUS authorization for LAN users based on scheme rd and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authorization lan-access radius-scheme rd local

Related commands

authorization default

local-user

radius scheme

authorization login

Use authorization login to specify authorization methods for login users.

Use undo authorization login to restore the default.

Syntax

In non-FIPS mode:

authorization login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] [ none ] | local [ none ] | none | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] [ none ] }

undo authorization login

In FIPS mode:

authorization login { hwtacacs-scheme hwtacacs-scheme-name [ radius-scheme radius-scheme-name ] [ local ] | local | radius-scheme radius-scheme-name [ hwtacacs-scheme hwtacacs-scheme-name ] [ local ] }

undo authorization login

Default

The default authorization methods of the ISP domain are used for login users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

local: Performs local authorization.

none: Does not perform authorization. The following default authorization information applies after users pass authentication:

·     Login users obtain the level-0 user role. Login users include the Telnet, FTP, SFTP, SCP, and terminal users. Terminal users can access the device through the console port. For more information about the level-0 user role, see RBAC configuration in Fundamentals Configuration Guide.

·     The working directory for FTP, SFTP, and SCP login users is the root directory of the NAS. However, the users do not have permission to access the root directory.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization login radius-scheme radius-scheme-name local none command specifies the default RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when the RADIUS server is invalid. The device does not perform authorization when both of the previous methods are invalid.

Examples

# In ISP domain test, perform local authorization for login users.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authorization login local

# In ISP domain test, perform RADIUS authorization for login users based on scheme rd and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authorization login radius-scheme rd local

Related commands

authorization default

hwtacacs scheme

local-user

radius scheme

authorization portal

Use authorization portal to specify authorization methods for portal users.

Use undo authorization portal to restore the default.

Syntax

In non-FIPS mode:

authorization portal { local [ none ] | none | radius-scheme radius-scheme-name [ local ] [ none ] }

undo authorization portal

In FIPS mode:

authorization portal { local | radius-scheme radius-scheme-name [ local ] }

undo authorization portal

Default

The default authorization methods of the ISP domain are used for portal users.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

local: Performs local authorization.

none: Does not perform authorization. An authenticated portal user directly accesses the network.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

The RADIUS authorization configuration takes effect only when the authentication method and authorization method of the ISP domain use the same RADIUS scheme.

You can specify one primary authorization method and multiple backup authorization methods.

When the default authorization method is invalid, the device attempts to use the backup authorization methods in sequence. For example, the authorization portal radius-scheme radius-scheme-name local none command specifies the default RADIUS authorization method and two backup methods (local authorization and no authorization). The device performs RADIUS authorization by default and performs local authorization when the RADIUS server is invalid. The device does not perform authorization when both of the previous methods are invalid.

Examples

# In ISP domain test, perform local authorization for portal users.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authorization portal local

# In ISP domain test, perform RADIUS authorization for portal users based on scheme rd and use local authorization as the backup.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authorization portal radius-scheme rd local

Related commands

authorization default

local-user

radius scheme

authorization-attribute (ISP domain view)

Use authorization-attribute to configure authorization attributes for users in an ISP domain.

Use undo authorization-attribute to restore the default of an authorization attribute.

Syntax

authorization-attribute { acl acl-number | car inbound cir committed-information-rate [ pir peak-information-rate ] outbound cir committed-information-rate [ pir peak-information-rate ] | igmp max-access-number max-access-number | ip-pool ipv4-pool-name | ipv6-pool ipv6-pool-name | mld max-access-number max-access-number | url url-string | user-group user-group-name | user-profile profile-name }

undo authorization-attribute { acl | car | igmp | ip-pool | ipv6-pool | mld | url | user-group | user-profile }

Default

An IPv4 user can concurrently join a maximum of four IGMP multicast groups.

An IPv6 user can concurrently join a maximum of four MLD multicast groups.

No other authorization attributes exist.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

acl acl-number: Specifies an ACL to filter traffic for users. The value range for the acl-number argument is 2000 to 4999. This option is applicable only to portal and LAN users. The device processes the traffic that matches the rules in the authorization ACL based on the permit or deny statement in the rules.

car: Specifies a CAR action for users. Typically, the attribute applies to authenticated users. If you configure the attribute in a portal preauthentication domain, the CAR action applies before portal authentication. This keyword is applicable only to portal users.

inbound: Specifies the upload rate of users.

outbound: Specifies the download rate of users.

cir committed-information-rate: Specifies the committed information rate in kbps, in the range of 1 to 4194303.

pir peak-information-rate: Specifies the peak information rate in kbps, in the range of 1 to 4194303. The peak information rate cannot be smaller than the committed information rate. If you do not specify this option, the CAR action does not restrict users by peak information rate.

igmp max-access-number max-access-number: Specifies the maximum number of IGMP groups that an IPv4 user can join concurrently. The value range for the max-access-number argument is 1 to 64. This option is applicable only to portal users.

ip-pool ipv4-pool-name: Specifies an IPv4 address pool for users. The ipv4-pool-name argument is a case-insensitive string of 1 to 63 characters. This option is applicable only to portal users.

ipv6-pool ipv6-pool-name: Specifies an IPv6 address pool for users. The ipv6-pool-name argument is a case-insensitive string of 1 to 63 characters. This option is applicable only to portal users.

mld max-access-number max-access-number: Specifies the maximum number of MLD groups that an IPv6 user can join concurrently. The value range for the max-access-number argument is 1 to 64. This option is applicable only to portal users.

url url-string: Specifies a redirect URL for users. Users are redirected to the URL the first time they access the network after they pass authentication. The url-string argument is a case-sensitive string of 1 to 255 characters. This option is applicable only to LAN users.

user-group user-group-name: Specifies a user group for users. The user-group-name argument is a case-insensitive string of 1 to 32 characters. Authenticated users obtain all attributes of the user group.

user-profile profile-name: Specifies an authorization user profile. The profile-name argument is a case-sensitive string of 1 to 31 characters. Typically, the attribute applies to authenticated users. If you configure the attribute in a portal preauthentication domain, the user profile applies before portal authentication. This option is applicable only to portal and LAN users.

Usage guidelines

If the server or NAS does not authorize a type of attribute to an authenticated user, the device authorizes the attribute in the ISP domain to the user.

You can configure multiple authorization attributes for users in an ISP domain. If you execute the command multiple times with the same attribute specified, the most recent configuration takes effect.

For portal users to come online after passing authentication, make sure ACLs assigned to portal users do not have rules specified with a source IP or MAC address.

Examples

# Specify user group abc as the authorization user group for users in ISP domain test.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] authorization-attribute user-group abc

Related commands

display domain

display domain

Use display domain to display ISP domain configuration.

Syntax

display domain [ isp-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

isp-name: Specifies an ISP domain by its name, a case-insensitive string of 1 to 255 characters. If you do not specify an ISP domain, this command displays the configuration of all ISP domains.

Examples

# Display the configuration of all ISP domains.

<Sysname> display domain

Total 2 domains

 

Domain: system

  State: Active

  Default authentication scheme:  Local

  Default authorization  scheme:  Local

  Default accounting     scheme:  Local

  Accounting start failure action: Online

  Accounting update failure action: Online

  Accounting quota out policy: Offline

  Service type: HSI

  Session time: Exclude idle time

  Dual-stack accounting method: Merge

  Authorization attributes:

    Idle cut: Disabled

    IGMP access limit: 4

    MLD access limit: 4

 

Domain: dm

  State: Active

  Login   authentication scheme:  RADIUS=rad

  Login   authorization  scheme:  HWTACACS=hw

  Super   authentication scheme:  RADIUS=rad

  Command authorization  scheme:  HWTACACS=hw

  LAN access authentication scheme:  RADIUS=r4

  Portal  authentication scheme:  LDAP=ldp

  Default authentication scheme:  RADIUS=rad, Local, None

  Default authorization  scheme:  Local

  Default accounting     scheme:  None

  Accounting start failure action: Online

  Accounting update failure action: Online

  Accounting quota out policy: Offline

  Service type: HSI

  Session time: Include idle time

  Dual-stack accounting method: Merge

  Authorization attributes:

    Idle cut : Disabled

    IP pool: appy

    User profile: test

    Inbound CAR: CIR 64000 bps PIR 640000 bps

    Outbound CAR: CIR 64000 bps PIR 640000 bps

    ACL number: 3000

    User group: ugg

    IPv6 pool: ipv6pool

    URL: http://test

    IGMP access limit: 4

    MLD access limit: 4

 

Default domain name: system

Table 1 Command output

Field

Description

Domain

ISP domain name.

State

Status of the ISP domain.

Default authentication scheme

Default authentication methods.

Default authorization scheme

Default authorization methods.

Default accounting scheme

Default accounting methods.

Login authentication scheme

Authentication methods for login users.

Login authorization scheme

Authorization methods for login users.

Login accounting scheme

Accounting methods for login users.

Super authentication scheme

Authentication methods for obtaining another user role without reconnecting to the device.

Command authorization scheme

Command line authorization methods.

Command accounting scheme

Command line accounting method.

LAN access authentication scheme

Authentication methods for LAN users.

LAN access authorization scheme

Authorization methods for LAN users.

LAN access accounting scheme

Accounting methods for LAN users.

Portal authentication scheme

Authentication methods for portal users.

Portal authorization scheme

Authorization methods for portal users.

Portal accounting scheme

Accounting methods for portal users.

RADIUS

RADIUS scheme.

HWTACACS

HWTACACS scheme.

LDAP

LDAP scheme.

Local

Local scheme.

None

No authentication, no authorization, or no accounting.

Accounting start failure action

Access control for users that encounter accounting-start failures:

·     Online—Allows the users to stay online.

·     Offline—Logs off the users.

Accounting update failure max-times

Maximum number of consecutive accounting-update failures allowed by the device for each user in the domain.

Accounting update failure action

Access control for users that have failed all their accounting-update attempts:

·     Online—Allows the users to stay online.

·     Offline—Logs off the users.

Accounting quota out policy

Access control for users that have used up their accounting quotas:

·     Online—Allows the users to stay online.

·     Offline—Logs off the users.

Service type

This field is not supported in the current software version.

Service type of the ISP domain, including HSI, STB, and VoIP.

Session time

Online duration sent to the server for users that went offline due to connection failure or malfunction:

·     Include idle time—The online duration includes the idle timeout period.

·     Exclude idle time—The online duration does not include the idle timeout period.

Dual-stack accounting method

This field is not supported in the current software version.

Accounting method for dual-stack users:

·     Merge—Merges IPv4 data with IPv6 data for accounting.

·     Separate—Separates IPv4 data from IPv6 data for accounting.

Authorization attributes

Authorization attributes for users in the ISP domain.

Idle cut

This field is not supported in the current software version.

Idle cut feature status:

·     Enabled—The feature is enabled. The device logs off users that do not meet the minimum traffic requirements in an idle timeout period.

·     Disabled—The feature is disabled. It is the default idle cut state.

IP pool

Name of the authorization IPv4 address pool.

User profile

Name of the authorization user profile.

Inbound CAR

Authorization inbound CAR:

·     CIR—Committed information rate in bps.

·     PIR—Peak information rate in bps.

If no inbound CAR is authorized, this field displays N/A.

Outbound CAR

Authorization outbound CAR:

·     CIR—Committed information rate in bps.

·     PIR—Peak information rate in bps.

If no outbound CAR is authorized, this field displays N/A.

ACL number

Authorization ACL for users.

User group

Authorization user group for users.

IPv6 pool

Name of the authorization IPv6 address pool for users.

URL

Authorization redirect URL for users.

IGMP access limit

Maximum number of IGMP groups that an IPv4 user is authorized to join concurrently.

MLD access limit

Maximum number of MLD groups that an IPv6 user is authorized to join concurrently.

 

domain

Use domain to create an ISP domain and enter its view, or enter the view of an existing ISP domain.

Use undo domain to delete an ISP domain.

Syntax

domain isp-name

undo domain isp-name

Default

A system-defined ISP domain exists. The domain name is system.

Views

System view

Predefined user roles

network-admin

Parameters

isp-name: Specifies the ISP domain name, a case-insensitive string of 1 to 255 characters. The name must meet the following requirements:

·     The name cannot contain a forward slash (/), backslash (\), vertical bar (|), quotation marks ("), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

·     The name cannot be d, de, def, defa, defau, defaul, default, i, if, if-, if-u, if-un, if-unk, if-unkn, if-unkno, if-unknow, or if-unknown.

Usage guidelines

All ISP domains are in active state when they are created.

You can modify settings for the system-defined ISP domain system, but you cannot delete this domain.

An ISP domain cannot be deleted when it is the default ISP domain. Before you use the undo domain command, change the domain to a non-default ISP domain by using the undo domain default enable command.

Use short domain names to ensure that user names containing a domain name do not exceed the maximum name length required by different types of users.

Examples

# Create an ISP domain named test and enter ISP domain view.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test]

Related commands

display domain

domain default enable

domain if-unknown

state (ISP domain view)

domain default enable

Use domain default enable to specify the default ISP domain. Users without any domain name included in the usernames are considered in the default domain.

Use undo domain default enable to restore the default.

Syntax

domain default enable isp-name

undo domain default enable

Default

The default ISP domain is the system-defined ISP domain system.

Views

System view

Predefined user roles

network-admin

Parameters

isp-name: Specifies the ISP domain name, a case-insensitive string of 1 to 255 characters. The ISP domain must already exist.

Usage guidelines

The system has only one default ISP domain.

An ISP domain cannot be deleted when it is the default ISP domain. Before you use the undo domain command, change the domain to a non-default ISP domain by using the undo domain default enable command.

Examples

# Create an ISP domain named test, and configure the domain as the default ISP domain.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] quit

[Sysname] domain default enable test

Related commands

display domain

domain

domain if-unknown

Use domain if-unknown to specify an ISP domain to accommodate users that are assigned to nonexistent domains.

Use undo domain if-unknown to restore the default.

Syntax

domain if-unknown isp-name

undo domain if-unknown

Default

No ISP domain is specified to accommodate users that are assigned to nonexistent domains.

Views

System view

Predefined user roles

network-admin

Parameters

isp-name: Specifies the ISP domain name, a case-insensitive string of 1 to 255 characters. The name must meet the following requirements:

·     The name cannot contain a forward slash (/), backslash (\), vertical bar (|), quotation marks ("), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

·     The name cannot be d, de, def, defa, defau, defaul, default, i, if, if-, if-u, if-un, if-unk, if-unkn, if-unkno, if-unknow, or if-unknown.

Usage guidelines

The device chooses an authentication domain for each user in the following order:

1.     The authentication domain specified for the access module.

2.     The ISP domain in the username.

3.     The default ISP domain of the device.

If the chosen domain does not exist on the device, the device searches for the ISP domain that accommodates users assigned to nonexistent domains. If no such ISP domain is configured, user authentication fails.

 

 

NOTE:

Support for the authentication domain configuration depends on the access module.

 

Examples

# Specify ISP domain test to accommodate users that are assigned to nonexistent domains.

<Sysname> system-view

[Sysname] domain if-unknown test

Related commands

display domain

local-server log change-password-prompt

Use local-server log change-password-prompt to enable password change prompt logging.

Use undo local-server log change-password-prompt to disable password change prompt logging.

Syntax

local-server log change-password-prompt

undo local-server log change-password-prompt

 

NOTE:

This command is supported only in Release 6320 and later.

Default

Password change prompt logging is enabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Use this feature to enhance the protection of passwords for Telnet, SSH, HTTP, HTTPS, NETCONF over SSH, and NETCONF over SOAP users and improve the system security.

This feature enables the device to generate logs to prompt users to change their weak passwords at an interval of 24 hours and at the users' login.

A password is a weak password if it does not meet the following requirements:

·     Password composition restriction configured by using the password-control composition command.

·     Minimum password length restriction set by using the password-control length command.

·     It cannot contain the username or the reverse letters of the username.

For a NETCONF over SSH or NETCONF over SOAP user, the device also generates a password change prompt log if any of the following conditions exists:

·     The current password of the user is the default password or has expired.

·     The user logs in to the device for the first time or uses a new password to log in after global password control is enabled.

The device will no longer generate password change prompt logs for a user when one of the following conditions exists:

·     The password change prompt logging feature is disabled.

·     The user has changed the password and the new password meets the password control requirements.

·     The enabling status of a related password control feature has changed so the current password of the user meets the password control requirements.

·     The password composition policy or the minimum password length has changed.

You can use the display password-control command to display password control configuration. For more information about password control commands, see "Password control commands."

Examples

# Enable password change prompt logging.

<Sysname> system-view

[Sysname] local-server log change-password-prompt

Related commands

display password-control

password-control composition

password-control length

nas-id bind vlan

Use nas-id bind vlan to bind a NAS-ID with a VLAN.

Use undo nas-id bind vlan to remove a NAS-ID and VLAN binding.

Syntax

nas-id nas-identifier bind vlan vlan-id

undo nas-id nas-identifier bind vlan vlan-id

Default

No NAS-ID and VLAN bindings exist.

Views

NAS-ID profile view

Predefined user roles

network-admin

Parameters

nas-identifier: Specifies a NAS-ID, a case-sensitive string of 1 to 31 characters.

vlan-id: Specifies a VLAN ID in the range of 1 to 4094.

Usage guidelines

You can configure multiple NAS-ID and VLAN bindings in a NAS-ID profile.

A NAS-ID can be bound with more than one VLAN, but a VLAN can be bound with only one NAS-ID. If you configure multiple bindings for the same VLAN, the most recent configuration takes effect.

Examples

# Bind NAS-ID 222 with VLAN 2 in NAS-ID profile aaa.

<Sysname> system-view

[Sysname] aaa nas-id profile aaa

[Sysname-nas-id-prof-aaa] nas-id 222 bind vlan 2

Related commands

aaa nas-id profile

session-time include-idle-time

Use session-time include-idle-time to configure the device to include the idle timeout period in the user online duration sent to the server.

Use undo session-time include-idle-time to restore the default.

Syntax

session-time include-idle-time

undo session-time include-idle-time

Default

The device does not include the idle timeout period in the user online duration sent to the server.

Views

ISP domain view

Predefined user roles

network-admin

Usage guidelines

Whether to configure the device to include the idle timeout period in the user online duration sent to the server, depending on the accounting policy in your network. The idle timeout period is assigned to users by the authorization server after the users pass authentication. For portal users, the device includes the idle timeout period set for the online portal user detection feature in the user online duration. For more information about online detection for portal users, see portal authentication configuration in Security Configuration Guide.

If the user goes offline due to connection failure or malfunction, the user online duration sent to the server is not the same as the actual online duration.

·     If the session-time include-idle-time command is used, the user's online duration sent to the server includes the idle timeout period. The online duration that is generated on the server is longer than the actual online duration of the user.

·     If the undo session-time include-idle-time command is used, the user's online duration sent to the server excludes the idle timeout period. The online duration that is generated on the server is shorter than the actual online duration of the user.

Examples

# Configure the device to include the idle timeout period in the online duration sent to the server for users in ISP domain test.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] session-time include-idle-time

Related commands

display domain

state (ISP domain view)

Use state to set the status of an ISP domain.

Use undo state to restore the default.

Syntax

state { active | block }

undo state

Default

An ISP domain is in active state.

Views

ISP domain view

Predefined user roles

network-admin

Parameters

active: Places the ISP domain in active state to allow the users in the ISP domain to request network services.

block: Places the ISP domain in blocked state to prevent users in the ISP domain from requesting network services.

Usage guidelines

By blocking an ISP domain, you disable offline users of the domain from requesting network services. However, the online users are not affected.

Examples

# Place ISP domain test in blocked state.

<Sysname> system-view

[Sysname] domain test

[Sysname-isp-test] state block

Related commands

display domain

Local user commands

access-limit

Use access-limit to set the maximum number of concurrent logins using the local user name.

Use undo access-limit to restore the default.

Syntax

access-limit max-user-number

undo access-limit

Default

The number of concurrent logins using the local user name is not limited.

Views

Local user view

Predefined user roles

network-admin

Parameters

max-user-number: Specifies the maximum number of concurrent logins, in the range of 1 to 1024.

Usage guidelines

This command takes effect only when local accounting is configured for the local user. The command does not apply to FTP, SFTP, or SCP users. These users do not support accounting.

For this command to take effect on network access users, you also need to execute the accounting start-fail offline command in the ISP domain view.

Examples

# Set the maximum number of concurrent logins to 5 for users using the local user name abc.

<Sysname> system-view

[Sysname] local-user abc

[Sysname-luser-manage-abc] access-limit 5

Related commands

accounting start-fail offline

display local-user

authorization-attribute (local user view/user group view)

Use authorization-attribute to configure authorization attributes for a local user or user group. After the local user or a local user in the user group passes authentication, the device assigns these attributes to the user.

Use undo authorization-attribute to restore the default of an authorization attribute.

Syntax

authorization-attribute { acl acl-number | idle-cut minutes | ip-pool ipv4-pool-name | ipv6-pool ipv6-pool-name | session-timeout minutes | user-profile profile-name | user-role role-name | vlan vlan-id | work-directory directory-name } *

undo authorization-attribute { acl | idle-cut | ip-pool | ipv6-pool | session-timeout | user-profile | user-role role-name | vlan | work-directory } *

Default

The working directory for FTP, SFTP, and SCP users is the root directory of the NAS. However, the users do not have permission to access the root directory.

The local users created by a network-admin or level-15 user are assigned the network-operator user role.

Views

Local user view

User group view

Predefined user roles

network-admin

Parameters

acl acl-number: Specifies an authorization ACL. The value range for the acl-number argument is 2000 to 4999. The device processes the traffic that matches the rules in the authorization ACL based on the permit or deny statement in the rules.

idle-cut minutes: Specifies an idle timeout period in minutes. The value range for the minutes argument is 1 to 120. An online user is logged out if its idle period exceeds the specified idle timeout period.

ip-pool ipv4-pool-name: Specifies an IPv4 address pool for the user. The ipv4-pool-name argument is a case-insensitive string of 1 to 63 characters.

ipv6-pool ipv6-pool-name: Specifies an IPv6 address pool for the user. The ipv6-pool-name argument is a case-insensitive string of 1 to 63 characters.

session-timeout minutes: Specifies the session timeout timer for the user, in minutes. The value range for the minutes argument is 1 to 1440. The device logs off the user after the timer expires.

user-profile profile-name: Specifies an authorization user profile by its name. The profile-name argument is a case-sensitive string of 1 to 31 characters. The name can contain only letters, digits, and underscores (_). The user profile restricts the behavior of authenticated users. For more information, see Security Configuration Guide.

user-role role-name: Specifies an authorized user role. The role-name argument is a case-sensitive string of 1 to 63 characters. A maximum of 64 user roles can be specified for a user. For user role-related commands, see Fundamentals Command Reference for RBAC commands. This option is available only in local user view, and is not available in user group view.

vlan vlan-id: Specifies an authorized VLAN. The value range for the vlan-id argument is 1 to 4094. After passing authentication and being authorized a VLAN, a local user can access only the resources in this VLAN.

work-directory directory-name: Specifies the working directory for FTP, SFTP, or SCP users. The directory-name argument is a case-insensitive string of 1 to 255 characters. The directory must already exist.

Usage guidelines

Configure authorization attributes according to the application environments and purposes. Support for authorization attributes depends on the service types of users.

For portal users, only the following authorization attributes take effect: acl, ip-pool, ipv6-pool, user-profile, and session-timeout.

For LAN users, only the following authorization attributes take effect: acl, session-timeout, user-profile, and vlan.

For SSH, Telnet, and terminal users, only the authorization attributes idle-cut and user-role take effect.

For HTTP and HTTPS users, only the authorization attribute user-role takes effect.

For FTP users, only the authorization attributes user-role and work-directory take effect.

For other types of local users, no authorization attribute takes effect.

Authorization attributes configured for a user group are intended for all local users in the group. You can group local users to improve configuration and management efficiency. An authorization attribute configured in local user view takes precedence over the same attribute configured in user group view.

For portal users to come online after passing authentication, make sure ACLs assigned to portal users do not have rules specified with a source IP or MAC address.

To make sure FTP, SFTP, and SCP users can access the directory after an IRF master/subordinate switchover, do not specify slot information for the working directory.

To make sure the user have only the user roles authorized by using this command, use the undo authorization-attribute user-role command to remove the default user role.

The security-audit user role has access to the commands for managing security log files and security log file system. To display all the accessible commands of the security-audit user role, use the display role name security-audit command. For more information about security log management, see Network Management and Monitoring Configuration Guide. For more information about file system management, see Fundamentals Configuration Guide.

You cannot delete a local user if the local user is the only user that has the security-audit user role.

The security-audit user role is mutually exclusive with other user roles.

·     When you assign the security-audit user role to a local user, the system requests confirmation for deleting all the other user roles of the user.

·     When you assign other user roles to a local user that has the security-audit user role, the system requests confirmation for deleting the security-audit user role for the local user.

Examples

# Configure the authorized VLAN of network access user abc as VLAN 2.

<Sysname> system-view

[Sysname] local-user abc class network

[Sysname-luser-network-abc] authorization-attribute vlan 2

# Configure the authorized VLAN of user group abc as VLAN 3.

<Sysname> system-view

[Sysname] user-group abc

[Sysname-ugroup-abc] authorization-attribute vlan 3

# Assign the security-audit user role to device management user xyz as the authorized user role.

<Sysname> system-view

[Sysname] local-user xyz class manage

[Sysname-luser-manage-xyz] authorization-attribute user-role security-audit

This operation will delete all other roles of the user. Are you sure? [Y/N]:y

Related commands

display local-user

display user-group

bind-attribute

Use bind-attribute to configure binding attributes for a local user.

Use undo bind-attribute to remove binding attributes of a local user.

Syntax

bind-attribute { ip ip-address | location interface interface-type interface-number | mac mac-address | vlan vlan-id } *

undo bind-attribute { ip | location | mac | vlan } *

Default

No binding attributes are configured for a local user.

Views

Local user view

Predefined user roles

network-admin

Parameters

ip ip-address: Specifies the IP address to which the user is bound. This option applies only to 802.1X users.

location interface interface-type interface-number: Specifies the interface to which the user is bound. The interface-type argument represents the interface type, and the interface-number argument represents the interface number. To pass authentication, the user must access the network through the bound interface. This option applies only to device management, LAN, and portal users.

mac mac-address: Specifies the MAC address of the user in the format H-H-H. This option applies only to LAN and portal users.

vlan vlan-id: Specifies the VLAN to which the user belongs. The vlan-id argument is in the range of 1 to 4094. This option applies only to LAN and portal users.

Usage guidelines

To perform local authentication of a user, the device matches the actual user attributes with the configured binding attributes. If the user has a non-matching attribute or lacks a required attribute, the user will fail authentication.

Binding attribute check takes effect on all access services. Configure the binding attributes for a user based on the access services and make sure the device can obtain all attributes to be checked from the user's packet. For example, you can configure an IP address binding for an 802.1X user, because 802.1X authentication can include the user's IP address in the packet. However, you cannot configure IP address bindings for MAC authentication users, because MAC authentication does not use IP addresses.

The binding interface type must meet the requirements of the local user. Configure the binding interface based on the service type of the user.

·     If the user is an 802.1X user, specify the 802.1X-enabled Layer 2 Ethernet interface or Layer 2 aggregate interface.

·     If the user is a MAC authentication user, specify the MAC authentication-enabled Layer 2 Ethernet interface or Layer 2 aggregate interface.

·     If the user is a Web authentication user, specify the Web authentication-enabled Layer 2 Ethernet interface.

·     If the user is a portal user, specify the portal-enabled interface. Specify the Layer 2 Ethernet interface if portal is enabled on a VLAN interface and the portal roaming enable command is not configured.

Examples

# Bind MAC address 11-11-11 with network access user abc.

<Sysname> system-view

[Sysname] local-user abc class network

[Sysname-luser-network-abc] bind-attribute mac 11-11-11

Related commands

display local-user

description

Use description to configure a description for a network access user.

Use undo description to restore the default.

Syntax

description text

undo description

Default

No description is configured for a network access user.

Views

Network access user view

Predefined user roles

network-admin

Parameters

text: Configures a description, case-sensitive string of 1 to 255 characters.

Examples

# Configure a description for network access user 123.

<Sysname> system-view

[Sysname] local-user 123 class network

[Sysname-luser-network-123] description Manager of MSC company

Related commands

display local-user

display local-user

Use display local-user to display the local user configuration and online user statistics.

Syntax

display local-user [ class { manage | network } | idle-cut { disable | enable } | service-type { ftp | http | https | lan-access | portal | ssh | telnet | terminal } | state { active | block } | user-name user-name class { manage | network } | vlan vlan-id ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

class: Specifies the local user type.

manage: Device management user.

network: Network access user.

idle-cut { disable | enable }: Specifies local users by the status of the idle cut feature.

service-type: Specifies the local users that use a specific type of service.

ftp: FTP users.

http: HTTP users.

https: HTTPS users.

lan-access: LAN users that typically access the network through an Ethernet, such as 802.1X users.

portal: Portal users.

ssh: SSH users.

telnet: Telnet users.

terminal: Terminal users that log in through console ports.

state { active | block }: Specifies local users in active or blocked state. A local user in active state can access network services, but a local user in blocked state cannot.

user-name user-name: Specifies all local users using the specified username. The username must be a case-sensitive string of 1 to 55 characters. The name must meet the following requirements:

·     Cannot contain the domain name.

·     Cannot contain any of the following characters: forward slash (/), backslash (\), vertical bar (|), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

·     Cannot be a, al, or all.

vlan vlan-id: Specifies all local users in a VLAN. The vlan-id argument is in the range of 1 to 4094.

Usage guidelines

If you do not specify any parameters, this command displays information about all local users.

Examples

# Display information about all local users.

<Sysname> display local-user

Device management user root:

  State:                     Active

  Service type:              SSH/Telnet/Terminal

  Access limit:              Enabled           Max access number: 3

  Current access number:     1

  User group:                system

  Bind attributes:

  Authorization attributes:

    Work directory:          flash:

    User role list:          network-admin

  Password control configurations:

    Password aging:          3 days

  Password history was last reset: 0 days ago

 

Network access user jj:

  State:                      Active

  Service type:               LAN-access

  User group:                 system

  Bind attributes:

    IP address:               2.2.2.2

    Location bound:           Ten-GigabitEthernet1/0/1

    MAC address:              0001-0001-0001

    VLAN ID:                  2

  Authorization attributes:

    Idle timeout:             33 minutes

    Work directory:           flash:

    ACL number:               2000

    User profile:               pp

    User role list:             network-operator, level-0, level-3

  Description:                A network access user from company cc

  Validity period:

    Start date and time:      2016/01/01-00:01:01

    Expiration date and time: 2017/01/01-01:01:01

  Password control configurations:

    Password length:          4 characters

 

Total 2 local users matched.

Table 2 Command output

Field

Description

State

Status of the local user: active or blocked.

Service type

Service types that the local user can use.

Access limit

Whether the concurrent login limit is enabled.

Max access number

Maximum number of concurrent logins using the local user name.

Current access number

Current number of concurrent logins using the local user name.

User group

Group to which the local user belongs.

Bind attributes

Binding attributes of the local user.

IP address

IP address of the local user.

Location bound

Binding port of the local user.

MAC address

MAC address of the local user.

VLAN ID

Binding VLAN of the local user.

Authorization attributes

Authorization attributes of the local user.

Idle timeout

Idle timeout period of the user, in minutes.

Session-timeout

Session timeout timer for the user, in minutes.

Work directory

Directory that the FTP, SFTP, or SCP user can access.

ACL number

Authorization ACL of the local user.

VLAN ID

Authorized VLAN of the local user.

User profile

Authorization user profile of the local user.

User role list

Authorized roles of the local user.

IP pool

IPv4 address pool authorized to the local user.

IPv6 pool

IPv6 address pool authorized to the local user.

Password control configurations

Password control attributes that are configured for the local user.

Password aging

Password expiration time.

Password length

Minimum number of characters that a password must contain.

Password composition

Password composition policy:

·     Minimum number of character types that a password must contain.

·     Minimum number of characters from each type in a password.

Password complexity

Password complexity checking policy:

·     Reject a password that contains the username or the reverse of the username.

·     Reject a password that contains any character repeated consecutively three or more times.

Maximum login attempts

Maximum number of consecutive failed login attempts.

Action for exceeding login attempts

Action to take on the user that failed to log in after using up all login attempts.

Password history was last reset

The most recent time that the history password records were cleared.

Description

Description of the network access user.

Validity period

Validity period of the network access user.

Start date and time

Date and time from which the network access user begins to take effect.

Expiration date and time

Date and time at which the network access user expires.

 

display user-group

Use display user-group to display user group configuration.

Syntax

display user-group { all | name group-name }

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

all: Specifies all user groups.

name group-name: Specifies a user group by its name, a case-insensitive string of 1 to 32 characters.

Examples

# Display the configuration of all user groups.

<Sysname> display user-group all

Total 2 user groups matched.

 

User group: system

  Authorization attributes:

    Work directory:          flash:

User group: jj

  Authorization attributes:

    Idle timeout:            2 minutes

    Work directory:          flash:/

    ACL number:              2000

    VLAN ID:                 2

    User profile:            pp

  Password control configurations:

    Password aging:          2 days

Table 3 Command output

Field

Description

User group

User group name.

Authorization attributes

Authorization attributes of the user group.

Idle timeout

Idle timeout period, in minutes.

Session-timeout

Session timeout timer, in minutes.

Work directory

Directory that FTP, SFTP, or SCP users in the group can access.

ACL number

Authorization ACL.

VLAN ID

Authorized VLAN.

User profile

Authorization user profile.

IP pool

IPv4 address pool authorized to the user group.

IPv6 pool

IPv6 address pool authorized to the user group.

Password control configurations

Password control attributes that are configured for the user group.

Password aging

Password expiration time.

Password length

Minimum number of characters that a password must contain.

Password composition

Password composition policy:

·     Minimum number of character types that a password must contain.

·     Minimum number of characters from each type in a password.

Password complexity

Password complexity checking policy:

·     Reject a password that contains the username or the reverse of the username.

·     Reject a password that contains any character repeated consecutively three or more times.

Maximum login attempts

Maximum number of consecutive failed login attempts.

Action for exceeding login attempts

Action to take on the user that failed to log in after using up all login attempts.

 

group

Use group to assign a local user to a user group.

Use undo group to restore the default.

Syntax

group group-name

undo group

Default

A local user belongs to user group system.

Views

Local user view

Predefined user roles

network-admin

Parameters

group-name: Specifies the user group name, a case-insensitive string of 1 to 32 characters.

Examples

# Assign device management user 111 to user group abc.

<Sysname> system-view

[Sysname] local-user 111 class manage

[Sysname-luser-manage-111] group abc

Related commands

display local-user

local-user

Use local-user to add a local user and enter its view, or enter the view of an existing local user.

Use undo local-user to delete local users.

Syntax

local-user user-name [ class { manage | network } ]

undo local-user { user-name class { manage | network } | all [ service-type { ftp | http | https | lan-access | portal | ssh | telnet | terminal } | class { manage | network } ] }

Default

No local users exist.

Views

System view

Predefined user roles

network-admin

Parameters

user-name: Specifies the local user name, a case-sensitive string of 1 to 55 characters. The name must meet the following requirements:

·     Cannot contain a domain name.

·     Cannot contain any of the following characters: forward slash (/), backslash (\), vertical bar (|), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

·     Cannot be a, al, or all.

class: Specifies the local user type. If you do not specify this keyword, the command adds a device management user.

manage: Device management user that can configure and monitor the device after login. Device management users can use FTP, HTTP, HTTPS, Telnet, SSH, and terminal services.

network: Network access user that accesses network resources through the device. Network access users can use LAN access and portal services.

all: Specifies all users.

service-type: Specifies the local users that use a specific type of service.

ftp: FTP users.

http: HTTP users.

https: HTTPS users.

lan-access: LAN users that typically access the network through an Ethernet, such as 802.1X users.

portal: Portal users.

ssh: SSH users.

telnet: Telnet users.

terminal: Terminal users that log in through console ports.

Examples

# Add a device management user named user1 and enter local user view.

<Sysname> system-view

[Sysname] local-user user1 class manage

[Sysname-luser-manage-user1]

# Add a network access user named user2 and enter local user view.

<Sysname> system-view

[Sysname] local-user user2 class network

[Sysname-luser-network-user2]

Related commands

display local-user

service-type (local user view)

local-user auto-delete enable

Use local-user auto-delete enable to enable the local user auto-delete feature.

Use undo local-user auto-delete enable to restore the default.

Syntax

local-user auto-delete enable

undo local-user auto-delete enable

Default

The local user auto-delete feature is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

This feature enables the device to examine the validity of local users at fixed time periods of 10 minutes and automatically delete expired local users.

Examples

# Enable the local user auto-delete feature.

<Sysname> system-view

[Sysname] local-user auto-delete enable

Related commands

validity-datetime

password (device management user view)

Use password to configure a password for a device management user.

Use undo password to restore the default.

Syntax

In non-FIPS mode:

password [ { hash | simple } string ]

undo password

In FIPS mode:

password

Default

In non-FIPS mode:

A device management user does not have a password and can pass authentication after entering the correct username and passing attribute checks.

In FIPS mode:

A device management user does not have a password and cannot pass authentication.

Views

Device management user view

Predefined user roles

network-admin

Parameters

hash: Specifies a password encrypted by the hash algorithm.

simple: Specifies a password in plaintext form. For security purposes, the password specified in plaintext form will be stored in hashed form.

string: Specifies the password string. This argument is case sensitive. In non-FIPS mode, the hashed form of the password is a string of 1 to 110 characters. The plaintext form of the password is a string of 1 to 63 characters. In FIPS mode, the password is in plaintext form and is a string of 15 to 63 characters. The string must contain digits, uppercase letters, lowercase letters, and special characters.

Usage guidelines

If you do not specify any parameters, you enter the interactive mode to set a plaintext password.

In non-FIPS mode, a device management user for which no password is specified can pass authentication after entering the correct username and passing attribute checks. To enhance security, configure a password for each device management user.

In FIPS mode, a password is required for a device management user to pass authentication. You must set the password in interactive mode.

When global password control is enabled, the device handles passwords of device management users as follows:

·     All passwords in the history records are saved in hashed form.

·     If a user changes its own password in plaintext form, the system requests the user to enter the current plaintext password. The new password must be different from all passwords in the history records and the current password. In addition, the new password must have a minimum of four characters different from the current password.

·     If a user changes the password for another user in plaintext form, the new password must be different from the latter user's all passwords in the history records and current password.

·     If a user deletes its own password, the system requests the user to enter the current plaintext password.

·     Except the above listed situations, the system does not request a user to enter the current plaintext password or compare the new password with passwords in the history records and the current password.

Examples

# Set the password to 123456TESTplat&! in plaintext form for device management user user1.

<Sysname> system-view

[Sysname] local-user user1 class manage

[Sysname-luser-manage-user1] password simple 123456TESTplat&!

# Configure the password in interactive mode for device management user test.

<Sysname> system-view

[Sysname] local-user test class manage

[Sysname-luser-manage-test] password

Password:

confirm :

Related commands

display local-user

password (network access user view)

Use password to configure a password for a network access user.

Use undo password to restore the default.

Syntax

password { cipher | simple } string

undo password

Default

A network access user does not have a password and can pass authentication after entering the correct username and passing attribute checks.

Views

Network access user view

Predefined user roles

network-admin

Parameters

cipher: Specifies a password in encrypted form.

simple: Specifies a password in plaintext form. For security purposes, the password specified in plaintext form will be stored in encrypted form.

string: Specifies the password string. Its plaintext form is a case-sensitive string of 1 to 63 characters. Its encrypted form is a case-sensitive string of 1 to 117 characters.

Usage guidelines

As a best practice to enhance security, configure a password for each network access user.

Examples

# Set the password to 123456TESTuser&! in plaintext form for network access user user1.

<Sysname> system-view

[Sysname] local-user user1 class network

[Sysname-luser-network-user1] password simple 123456TESTuser&!

Related commands

display local-user

service-type

Use service-type to specify the service types that a local user can use.

Use undo service-type to remove service types configured for a local user.

Syntax

In non-FIPS mode:

service-type { ftp | lan-access | { http | https | ssh | telnet | terminal } * | portal }

undo service-type { ftp | lan-access | { http | https | ssh | telnet | terminal } * | portal }

In FIPS mode:

service-type { lan-access | { https | ssh | terminal } * | portal }

undo service-type { lan-access | { https | ssh | terminal } * | portal }

Default

A local user is not authorized to use any service.

Views

Local user view

Predefined user roles

network-admin

Parameters

ftp: Authorizes the user to use the FTP service. The authorized directory can be modified by using the authorization-attribute work-directory command.

http: Authorizes the user to use the HTTP service.

https: Authorizes the user to use the HTTPS service.

lan-access: Authorizes the user to use the LAN access service. The users are typically Ethernet users, for example, 802.1X users.

ssh: Authorizes the user to use the SSH service.

telnet: Authorizes the user to use the Telnet service.

terminal: Authorizes the user to use the terminal service and log in from a console port.

portal: Authorizes the user to use the portal service.

Usage guidelines

You can assign multiple service types to a user.

Examples

# Authorize device management user user1 to use the Telnet and FTP services.

<Sysname> system-view

[Sysname] local-user user1 class manage

[Sysname-luser-manage-user1] service-type telnet

[Sysname-luser-manage-user1] service-type ftp

Related commands

display local-user

state (local user view)

Use state to set the status of a local user.

Use undo state to restore the default.

Syntax

state { active | block }

undo state

Default

A local user is in active state.

Views

Local user view

Predefined user roles

network-admin

Parameters

active: Places the local user in active state to allow the local user to request network services.

block: Places the local user in blocked state to prevent the local user from requesting network services.

Examples

# Place device management user user1 in blocked state.

<Sysname> system-view

[Sysname] local-user user1 class manage

[Sysname-luser-manage-user1] state block

Related commands

display local-user

user-group

Use user-group to create a user group and enter its view, or enter the view of an existing user group.

Use undo user-group to delete a user group.

Syntax

user-group group-name

undo user-group group-name

Default

A system-defined user group exists. The group name is system.

Views

System view

Predefined user roles

network-admin

Parameters

group-name: Specifies the user group name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

A user group consists of a group of local users and has a set of local user attributes. You can configure local user attributes for a user group to implement centralized management of user attributes for the local users in the group.

A user group that has local users cannot be deleted.

You can modify settings for the system-defined user group named system, but you cannot delete the user group.

Examples

# Create a user group named abc and enter user group view.

<Sysname> system-view

[Sysname] user-group abc

[Sysname-ugroup-abc]

Related commands

display user-group

validity-datetime

Use validity-datetime to specify the validity period for a network access user.

Use undo validity-datetime to restore the default.

Syntax

validity-datetime { from start-date start-time to expiration-date expiration-time | from start-date start-time | to expiration-date expiration-time }

undo validity-datetime

Default

The validity period for a local user does not expire.

Views

Network access user view

Predefined user roles

network-admin

Parameters

from: Specifies the validity start date and time for the user. If you do not specify this option, the command defines only the expiration date and time of the user.

start-date: Specifies the date on which the user becomes effective. The date is in the format of MM/DD/YYYY or YYYY/MM/DD. The value range for the MM argument is 1 to 12. The value range for the DD argument varies with the specified month. The value range for the YYYY argument is 2000 to 2035.

start-time: Specifies the time on the day when the user becomes effective. The time is in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59. The mm and ss arguments are optional. For example, enter 1 to indicate 1:00:00. A value of 0 indicates 00:00:00.

to: Specifies the expiration date and time for the user. If you do not specify this option, the command defines only the validity start date and time of the user.

expiration-date: Specifies the expiration date in the format of MM/DD/YYYY or YYYY/MM/DD. The value range for the MM argument is 1 to 12. The value range for the DD argument varies with the specified month. The value range for the YYYY argument is 2000 to 2035.

expiration-time: Specifies the expiration time in the format of hh:mm:ss. The value range for the hh argument is 0 to 23. The value range for the mm and ss arguments is 0 to 59. The mm and ss arguments are optional. For example, enter 1 to indicate 1:00:00. A value of 0 indicates 00:00:00.

Usage guidelines

Expired network access user accounts cannot be used for authentication.

When both from and to options are specified, the expiration date and time must be later than the validity start date and time.

When only the from option is specified, the user is valid since the specified date and time. When only the to option is specified, the user is valid until the specified date and time.

When the RADIUS server feature is enabled on the device, the RADIUS user data for authentication is automatically generated from the network access user configuration. The device ignores the validity start date and time of the RADIUS users.

Examples

# Specify the validity period for network access user 123.

<Sysname> system-view

[Sysname] local-user 123 class network

[Sysname-luser-network-123] validity-datetime from 2015/10/01 00:00:00 to 2016/10/02 12:00:00

Related commands

display local-user

RADIUS commands

aaa device-id

Use aaa device-id to configure the device ID.

Use undo aaa device-id to restore the default.

Syntax

aaa device-id device-id

undo aaa device-id

Default

The device ID is 0.

Views

System view

Predefined user roles

network-admin

Parameters

device-id: Specifies a device ID in the range of 1 to 255.

Usage guidelines

RADIUS uses the value of the Acct-Session-ID attribute as the accounting ID for a user. The device generates an Acct-Session-ID value for each online user based on the system time, random digits, and device ID.

If you modify the device ID, the new device ID does not take effect on users that have been online during the change.

Examples

# Configure the device ID as 1.

<Sysname> system-view

[Sysname] aaa device-id 1

accounting-on enable

Use accounting-on enable to configure the accounting-on feature.

Use undo accounting-on enable to disable the accounting-on feature.

Syntax

accounting-on enable [ interval interval | send send-times ] *

undo accounting-on enable

Default

The accounting-on feature is disabled.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

interval interval: Specifies the time interval for retransmitting an accounting-on packet in seconds. The value range for the interval argument is 1 to 15, and the default setting is 3.

send send-times: Specifies the maximum number of accounting-on packet transmission attempts. The value range for the send-times argument is 1 to 255, and the default setting is 50.

Usage guidelines

The accounting-on feature enables the device to automatically send an accounting-on packet to the RADIUS server after a device reboot. Upon receiving the accounting-on packet, the RADIUS server logs out all online users so they can log in again through the device.

Execute the save command to ensure that the accounting-on enable command takes effect at the next device reboot. For information about the save command, see Fundamentals Command Reference.

Parameters set by using the accounting-on enable command take effect immediately.

Examples

# Enable the accounting-on feature for RADIUS scheme radius1, and set the retransmission interval to 5 seconds and the transmission attempts to 15.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] accounting-on enable interval 5 send 15

Related commands

display radius scheme

accounting-on extended

Use accounting-on extended to enable the extended accounting-on feature.

Use undo accounting-on extended to disable the extended accounting-on feature.

Syntax

accounting-on extended

undo accounting-on extended

Default

The extended accounting-on feature is disabled.

Views

RADIUS scheme view

Predefined user roles

network-admin

network-operator

Usage guidelines

The extended accounting-on feature enhances the accounting-on feature by applying to a distributed architecture. For the extended accounting-on feature to take effect, the RADIUS server must run on IMC and the accounting-on feature must be enabled.

The extended accounting-on feature is applicable to LAN users. The user data is saved to the member devices through which the users access the IRF fabric.

When this feature is enabled, the IRF fabric automatically sends an accounting-on packet to the RADIUS server after a member device reboots (IRF fabric not reboot). The packet contains the member device identifier. Upon receiving the accounting-on packet, the RADIUS server logs out all online users that access the IRF fabric through the member device. If no users have come online through the member device, the IRF fabric does not send an accounting-on packet after the member device reboots.

The IRF fabric uses the packet retransmission interval and maximum transmission attempts set by using the accounting-on enable command for this feature.

Execute the save command to ensure that the accounting-on extended command takes effect at the next member device reboot. For information about the save command, see Fundamentals Command Reference.

Examples

# Enable the extended accounting-on feature for RADIUS scheme radius1.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] accounting-on extended

Related commands

accounting-on enable

display radius scheme

attribute 15 check-mode

Use attribute 15 check-mode to configure the Login-Service attribute check method for SSH, FTP, and terminal users.

Use undo attribute 15 check-mode to restore the default.

Syntax

attribute 15 check-mode { loose | strict }

undo attribute 15 check-mode

Default

The strict check method applies for SSH, FTP, and terminal users.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

loose: Matches the standard Login-Service attribute value 0 for SSH, FTP, and terminal services.

strict: Matches Login-Service attribute values 50, 51, and 52 for SSH, FTP, and terminal services, respectively.

Usage guidelines

Use the loose check method only when the server does not issue Login-Service attribute values 50, 51, and 52 for SSH, FTP, and terminal users.

Examples

# Configure the Login-Service attribute check method as loose for SSH, FTP, and terminal users in RADIUS scheme radius1.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 15 check-mode loose

Related commands

display radius scheme

attribute 25 car

Use attribute 25 car to configure the device to interpret the RADIUS class attribute (attribute 25) as CAR parameters.

Use undo attribute 25 car to restore the default.

Syntax

attribute 25 car

undo attribute 25 car

Default

The RADIUS class attribute is not interpreted as CAR parameters.

Views

RADIUS scheme view

Predefined user roles

network-admin

Usage guidelines

Configure the device to interpret the RADIUS class attribute if the RADIUS server uses the attribute to deliver CAR parameters for user-based traffic monitoring and control.

Examples

# In RADIUS scheme radius1, configure the device to interpret the RADIUS class attribute as CAR parameters.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 25 car

Related commands

display radius scheme

attribute 31 mac-format

Use attribute 31 mac-format to configure the MAC address format for RADIUS attribute 31.

Use undo attribute 31 mac-format to restore the default.

Syntax

attribute 31 mac-format section { one | { six | three } separator separator-character } { lowercase | uppercase }

undo attribute 31 mac-format

Default

A MAC address is in the format of HH-HH-HH-HH-HH-HH. The MAC address is separated by hyphens (-) into six sections with letters in upper case.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

section: Specifies the number of sections that a MAC address contains.

one: Specifies the one-section format HHHHHHHHHHHH. This keyword is available in Release 6312P01 and later.

six: Specifies the six-section format HH-HH-HH-HH-HH-HH.

three: Specifies the three-section format HHHH-HHHH-HHHH.

separator separator-character: Specifies a case-sensitive character that separates the sections.

lowercase: Specifies the letters in a MAC address to be in lower case.

uppercase: Specifies the letters in a MAC address to be in upper case.

Usage guidelines

Configure the MAC address format for RADIUS attribute 31 to meet the requirements of the RADIUS servers.

Examples

# In RADIUS scheme radius1, specify the MAC address format as hh:hh:hh:hh:hh:hh for RADIUS attribute 31.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute 31 mac-format section six separator : lowercase

Related commands

display radius scheme

attribute convert (RADIUS DAS view)

Use attribute convert to configure a RADIUS attribute conversion rule.

Use undo attribute convert to delete RADIUS attribute conversion rules.

Syntax

attribute convert src-attr-name to dest-attr-name { { coa-ack | coa-request } * | { received | sent } * }

undo attribute convert [ src-attr-name ]

Default

No RADIUS attribute conversion rules exist. The system processes RADIUS attributes according to the principles of the standard RADIUS protocol.

Views

RADIUS DAS view

Predefined user roles

network-admin

Parameters

src-attr-name: Specifies the source RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.

dest-attr-name: Specifies the destination RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.

coa-ack: Specifies the CoA acknowledgment packets.

coa-request: Specifies the CoA request packets.

received: Specifies the received DAE packets.

sent: Specifies the sent DAE packets.

Usage guidelines

The device replaces the attribute in packets that match a RADIUS attribute conversion rule with the destination RADIUS attribute in the rule.

The conversion rules take effect only when the RADIUS attribute translation feature is enabled.

When you configure RADIUS attribute conversion rules, follow these restrictions and guidelines:

·     The source and destination RADIUS attributes in a rule must use the same data type.

·     The source and destination RADIUS attributes in a rule cannot use the same name.

·     A source RADIUS attribute can be converted only by one criterion, packet type or direction.

·     One source RADIUS attribute cannot be converted to multiple destination attributes.

If you do not specify a source RADIUS attribute, the undo attribute convert command deletes all RADIUS attribute conversion rules.

Examples

# In RADIUS DAS view, configure a RADIUS attribute conversion rule to replace the Hw-Server-String attribute in the received DAE packets with the Connect-Info attribute.

<Sysname> system-view

[Sysname] radius dynamic-author server

[Sysname-radius-da-server] attribute convert Hw-Server-String to Connect-Info received

Related commands

attribute translate

attribute convert (RADIUS scheme view)

Use attribute convert to configure a RADIUS attribute conversion rule.

Use undo attribute convert to delete RADIUS attribute conversion rules.

Syntax

attribute convert src-attr-name to dest-attr-name { { access-accept | access-request | accounting } * | { received | sent } * }

undo attribute convert [ src-attr-name ]

Default

No RADIUS attribute conversion rules exist. The system processes RADIUS attributes according to the principles of the standard RADIUS protocol.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

src-attr-name: Specifies the source RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.

dest-attr-name: Specifies the destination RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.

access-accept: Specifies the RADIUS Access-Accept packets.

access-request: Specifies the RADIUS Access-Request packets.

accounting: Specifies the RADIUS accounting packets.

received: Specifies the received RADIUS packets.

sent: Specifies the sent RADIUS packets.

Usage guidelines

The device replaces the attribute in packets that match a RADIUS attribute conversion rule with the destination RADIUS attribute in the rule.

The conversion rules take effect only when the RADIUS attribute translation feature is enabled.

When you configure RADIUS attribute conversion rules, follow these restrictions and guidelines:

·     The source and destination RADIUS attributes in a rule must use the same data type.

·     The source and destination RADIUS attributes in a rule cannot use the same name.

·     A source RADIUS attribute can be converted only by one criterion, packet type or direction.

·     One source RADIUS attribute cannot be converted to multiple destination attributes.

If you do not specify a source RADIUS attribute, the undo attribute convert command deletes all RADIUS attribute conversion rules.

Examples

# In RADIUS scheme radius1, configure a RADIUS attribute conversion rule to replace the Hw-Server-String attribute of received RADIUS packets with the Connect-Info attribute.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute convert Hw-Server-String to Connect-Info received

Related commands

attribute translate

attribute reject (RADIUS DAS view)

Use attribute reject to configure a RADIUS attribute rejection rule.

Use undo attribute reject to delete RADIUS attribute rejection rules.

Syntax

attribute reject attr-name { { coa-ack | coa-request } * | { received | sent } * }

undo attribute reject [ attr-name ]

Default

No RADIUS attribute rejection rules exist.

Views

RADIUS DAS view

Predefined user roles

network-admin

Parameters

attr-name: Specifies a RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.

coa-ack: Specifies the CoA acknowledgment packets.

coa-request: Specifies the CoA request packets.

received: Specifies the received DAE packets.

sent: Specifies the sent DAE packets.

Usage guidelines

Configure RADIUS attribute rejection rules for the following purposes:

·     Delete attributes from the RADIUS packets to be sent if the destination RADIUS server does not identify the attributes.

·     Ignore unwanted attributes in the RADIUS packets received from a RADIUS server.

The RADIUS attribute rejection rules take effect only when the RADIUS attribute translation feature is enabled.

A RADIUS attribute can be rejected only by one criterion, packet type or direction.

If you do not specify a RADIUS attribute, the undo attribute reject command deletes all RADIUS attribute rejection rules.

Examples

# In RADIUS DAS view, configure a RADIUS attribute rejection rule to delete the Connect-Info attribute from the DAE packets to be sent.

<Sysname> system-view

[Sysname] radius dynamic-author server

[Sysname-radius-da-server] attribute reject Connect-Info sent

Related commands

attribute translate

attribute reject (RADIUS scheme view)

Use attribute reject to configure a RADIUS attribute rejection rule.

Use undo attribute reject to delete RADIUS attribute rejection rules.

Syntax

attribute reject attr-name { { access-accept | access-request | accounting } * | { received | sent } * }

undo attribute reject [ attr-name ]

Default

No RADIUS attribute rejection rules exist.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

attr-name: Specifies a RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The attribute must be supported by the system.

access-accept: Specifies the RADIUS Access-Accept packets.

access-request: Specifies the RADIUS Access-Request packets.

accounting: Specifies the RADIUS accounting packets.

received: Specifies the received RADIUS packets.

sent: Specifies the sent RADIUS packets.

Usage guidelines

Configure RADIUS attribute rejection rules for the following purposes:

·     Delete attributes from the RADIUS packets to be sent if the destination RADIUS server does not identify the attributes.

·     Ignore unwanted attributes in the RADIUS packets received from a RADIUS server.

The RADIUS attribute rejection rules take effect only when the RADIUS attribute translation feature is enabled.

A RADIUS attribute can be rejected only by one criterion, packet type or direction.

If you do not specify a RADIUS attribute, the undo attribute reject command deletes all RADIUS attribute rejection rules.

Examples

# In RADIUS scheme radius1, configure a RADIUS attribute rejection rule to delete the Connect-Info attribute from the RADIUS packets to be sent.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute reject Connect-Info sent

Related commands

attribute translate

attribute remanent-volume

Use attribute remanent-volume to set the data measurement unit for the Remanent_Volume attribute.

Use undo attribute remanent-volume to restore the default.

Syntax

attribute remanent-volume unit { byte | giga-byte | kilo-byte | mega-byte }

undo attribute remanent-volume unit

Default

The data measurement unit is kilobyte for the Remanent_Volume attribute.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

byte: Specifies the unit as byte.

giga-byte: Specifies the unit as gigabyte.

kilo-byte: Specifies the unit as kilobyte.

mega-byte: Specifies the unit as megabyte.

Usage guidelines

Make sure the measurement unit is the same as the user data measurement unit on the RADIUS server.

Examples

# In RADIUS scheme radius1, set the data measurement unit to kilobyte for the Remanent_Volume attribute.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute remanent-volume unit kilo-byte

Related commands

display radius scheme

attribute translate

Use attribute translate to enable the RADIUS attribute translation feature.

Use undo attribute translate to disable the RADIUS attribute translation feature.

Syntax

attribute translate

undo attribute translate

Default

The RADIUS attribute translation feature is disabled.

Views

RADIUS DAS view

RADIUS scheme view

Predefined user roles

network-admin

Usage guidelines

To cooperate with RADIUS servers of different vendors, enable the RADIUS attribute translation feature. Configure RADIUS attribute conversion rules and rejection rules to ensure that RADIUS attributes in the packets exchanged between the device and the server are supported by both sides.

Examples

# Enable the RADIUS attribute translation feature for RADIUS scheme radius1.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] attribute translate

Related commands

attribute convert (RADIUS DAS view)

attribute convert (RADIUS scheme view)

attribute reject (RADIUS DAS view)

attribute reject (RADIUS scheme view)

ca-file

Use ca-file to specify a CA certificate file for EAP authentication.

Use undo ca-file to restore the default.

Syntax

ca-file file-name

undo ca-file

Default

No CA certificate file is specified for EAP authentication. The device does not verify the RADIUS server certificate during EAP authentication.

Views

EAP profile view

Predefined user roles

network-admin

Parameters

file-name: Specifies a CA certificate file by its name, a case-sensitive string of 1 to 91 characters.

Usage guidelines

You must specify a CA certificate file to verify the RADIUS server certificate if the EAP authentication method is PEAP-GTC, PEAP-MSCHAPv2, TTLS-GTC, or TTLS-MSCHAPv2.

Before you specify a CA certificate file, you must use FTP or TFTP to transfer the CA certificate file to the root directory of the default storage medium on the device.

In an IRF fabric, make sure a CA certificate file already exists in the root directory of the default storage medium on the master device before you specify the file.

You can specify only one CA certificate file in an EAP profile. If you execute this command multiple times, the most recent configuration takes effect.

If you change the CA certificate file, the new CA certificate file takes effect at the next server status detection.

Examples

# In EAP profile eap1, specify CA certificate file CA.der for EAP authentication.

<Sysname> system-view

[Sysname] eap-profile eap1

[Sysname-eap-profile-eap1] ca-file CA.der

client

Use client to specify a RADIUS DAC.

Use undo client to remove a RADIUS DAC.

Syntax

client { ip ipv4-address | ipv6 ipv6-address } [ key { cipher | simple } string | vpn-instance vpn-instance-name ] *

undo client { ip ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ]

Default

No RADIUS DACs are specified.

Views

RADIUS DAS view

Predefined user roles

network-admin

Parameters

ip ipv4-address: Specifies a DAC by its IPv4 address.

ipv6 ipv6-address: Specifies a DAC by its IPv6 address.

key: Specifies the shared key for secure communication between the RADIUS DAC and server. Make sure the shared key is the same as the key configured on the RADIUS DAC. If the RADIUS DAC does not have any shared key, do not specify this option.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 117 characters. The plaintext form of the key is a string of 15 to 64 characters. The plaintext string must contain characters from digits, uppercase letters, lowercase letters, and special characters.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the RADIUS DAC belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

Usage guidelines

With the RADIUS DAS feature, the device listens to the default or specified UDP port to receive DAE requests from the specified DACs. The device processes the requests and sends DAE responses to the DACs.

The device discards any DAE packets sent from DACs that are not specified for the DAS.

You can execute the client command multiple times to specify multiple DACs for the DAS.

Examples

# Specify the DAC as 10.110.1.2. Set the shared key to 123456 in plaintext form for secure communication between the DAS and DAC.

<Sysname> system-view

[Sysname] radius dynamic-author server

[Sysname-radius-da-server] client ip 10.110.1.2 key simple 123456

Related commands

radius dynamic-author server

port

data-flow-format (RADIUS scheme view)

Use data-flow-format to set the data flow and packet measurement units for traffic statistics.

Use undo data-flow-format to restore the default.

Syntax

data-flow-format { data { byte | giga-byte | kilo-byte | mega-byte } | packet { giga-packet | kilo-packet | mega-packet | one-packet } } *

undo data-flow-format { data | packet }

Default

Traffic is counted in bytes and packets.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

data: Specifies the unit for data flows.

byte: Specifies the unit as byte.

giga-byte: Specifies the unit as gigabyte.

kilo-byte: Specifies the unit as kilobyte.

mega-byte: Specifies the unit as megabyte.

packet: Specifies the unit for data packets.

giga-packet: Specifies the unit as giga-packet.

kilo-packet: Specifies the unit as kilo-packet.

mega-packet: Specifies the unit as mega-packet.

one-packet: Specifies the unit as one-packet.

Usage guidelines

The data flow and packet measurement units for traffic statistics must be the same as configured on the RADIUS accounting servers. Otherwise, accounting results might be incorrect.

Examples

# In RADIUS scheme radius1, set the data flow and packet measurement units for traffic statistics to kilobyte and kilo-packet, respectively.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] data-flow-format data kilo-byte packet kilo-packet

Related commands

display radius scheme

display radius scheme

Use display radius scheme to display RADIUS scheme configuration.

Syntax

display radius scheme [ radius-scheme-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters. If you do not specify a RADIUS scheme, this command displays the configuration of all RADIUS schemes.

Examples

# Display the configuration of all RADIUS schemes.

<Sysname> display radius scheme

Total 1 RADIUS schemes

 

------------------------------------------------------------------

RADIUS scheme name: radius1

  Index : 0

  Primary authentication server:

    Host name: Not configured

    IP   : 2.2.2.2                                  Port: 1812

    VPN  : vpn1

    State: Active

    Test profile: 132

      Probe username: test

      Probe interval: 60 minutes

      Probe eap-profile: eap1

    Weight: 40

  Primary accounting server:

    Host name: Not configured

    IP   : 1.1.1.1                                  Port: 1813

    VPN  : Not configured

    State: Active

    Weight: 40

  Second authentication server:

    Host name: Not configured

    IP   : 3.3.3.3                                  Port: 1812

    VPN  : Not configured

    State: Block

    Test profile: Not configured

    Weight: 40

  Second accounting server:

    Host name: Not configured

    IP   : 3.3.3.3                                  Port: 1813

    VPN  : Not configured

    State: Block (Mandatory)

    Weight: 0

  Accounting-On function                     : Enabled

    extended function                        : Disabled

    retransmission times                     : 5

    retransmission interval(seconds)         : 2

  Timeout Interval(seconds)                  : 3

  Retransmission Times                       : 3

  Retransmission Times for Accounting Update : 5

  Server Quiet Period(minutes)               : 5

  Realtime Accounting Interval(seconds)      : 22

  Stop-accounting packets buffering          : Enabled

    Retransmission times                     : 500

  NAS IP Address                             : 1.1.1.1

  VPN                                        : Not configured

  User Name Format                           : with-domain

  Data flow unit                             : Megabyte

  Packet unit                                : One

  Attribute 15 check-mode                    : Strict

  Attribute 25                               : CAR

  Attribute Remanent-Volume unit             : Mega

  server-load-sharing                        : Enabled

  Attribute 31 MAC format                    : hh:hh:hh:hh:hh:hh

  Stop-accounting-packet send-force          : Disabled

  Reauthentication server selection          : Reselect

------------------------------------------------------------------

Table 4 Command output

Field

Description

Index

Index number of the RADIUS scheme.

Primary authentication server

Information about the primary authentication server.

Primary accounting server

Information about the primary accounting server.

Second authentication server

Information about the secondary authentication server.

Second accounting server

Information about the secondary accounting server.

Host name

Host name of the server.

This field displays Not configured in the following situations:

·     The server is not configured.

·     The server is specified by IP address.

IP

IP address of the server.

This field displays Not configured in the following situations:

·     The server is not configured.

·     The server is specified by hostname, and the hostname is not resolved.

Port

Service port number of the server. If no port number is specified, this field displays the default port number.

VPN

MPLS L3VPN instance to which the server or the RADIUS scheme belongs. If no VPN instance is specified for the server, this field displays Not configured.

State

Status of the server:

·     Active—The server is in active state.

·     Block—The server is changed to blocked state automatically.

·     Block (Mandatory)—The server is set to blocked state manually.

Test profile

Test profile used for RADIUS server status detection.

Probe username

Username used for RADIUS server status detection.

Probe interval

Server status detection interval, in minutes.

Probe eap-profile

EAP profile specified for RADIUS server status detection.

This field is not available if no EAP profile is specified in the test profile for RADIUS server status detection.

Weight

Weight value of the RADIUS server.

Accounting-On function

Whether the accounting-on feature is enabled.

extended function

Whether the extended accounting-on feature is enabled.

retransmission times

Number of accounting-on packet transmission attempts.

retransmission interval(seconds)

Interval at which the device retransmits accounting-on packets, in seconds.

Timeout Interval(seconds)

RADIUS server response timeout period, in seconds.

Retransmission times

Maximum number of attempts for transmitting a RADIUS packet to a single RADIUS server.

Retransmission Times for Accounting Update

Maximum number of accounting attempts.

Server Quiet Period(minutes)

Quiet period for the servers, in minutes.

Realtime Accounting Interval(seconds)

Interval for sending real-time accounting updates, in seconds.

Stop-accounting packets buffering

Whether buffering of nonresponded RADIUS stop-accounting requests is enabled.

Retransmission times

Maximum number of transmission attempts for individual RADIUS stop-accounting requests.

NAS IP Address

Source interface or source IP addresses for outgoing RADIUS packets.

This field displays Not configured if no source interface or source IP addresses are specified for outgoing RADIUS packets.

User Name Format

Format for the usernames sent to the RADIUS server:

·     with-domain—Includes the domain name.

·     without-domain—Excludes the domain name.

·     keep-original—Forwards the username as the username is entered.

Data flow unit

Measurement unit for data flow.

Packet unit

Measurement unit for packets.

Attribute 15 check-mode

RADIUS Login-Service attribute check method for SSH, FTP, and terminal users:

·     Strict—Matches Login-Service attribute values 50, 51, and 52 for SSH, FTP, and terminal services, respectively.

·     Loose—Matches the standard Login-Service attribute value 0 for SSH, FTP, and terminal services.

Attribute 25

RADIUS attribute 25 interpretation status:

·     Standard—The attribute is not interpreted as CAR parameters.

·     CAR—The attribute is interpreted as CAR parameters.

Attribute Remanent-Volume unit

Data measurement unit for the RADIUS Remanent_Volume attribute.

server-load-sharing

Status of the RADIUS server load sharing feature:

·     Disabled—The feature is disabled. The device forwards traffic to the server selected based on primary and secondary server roles.

·     Enabled—The feature is enabled. The device distributes traffic among multiple servers for load sharing.

Attribute 31 MAC format

MAC address format for RADIUS attribute 31.

Stop-accounting-packet send-force

Whether the device is enabled to forcibly send stop-accounting packets when users for which no start-accounting packets are sent go offline.

Reauthentication server selection

RADIUS server selection mode in reauthentication:

·     Inherit—The device uses the RADIUS server that performed authentication for a user to reauthenticate that user.

·     Reselect—The device searches for a reachable RADIUS server to reauthenticate a user.

 

display radius server-load statistics

Use display radius server-load statistics to display authentication and accounting load statistics for all RADIUS servers.

Syntax

display radius server-load statistics

Views

Any view

Predefined user roles

network-admin

network-operator

Usage guidelines

This command displays the following statistics:

·     Last-5-second statistics—Total number of authentication or accounting requests sent to each RADIUS server in the last 5 seconds.

·     History statistics—Total number of authentication or accounting requests sent to each RADIUS server since the device starts up.

The device collects the statistics as follows:

·     Last-5-second statistics—From the device sends the first authentication or accounting request to a RADIUS server, the device counts the number of authentication or accounting requests sent to the server every 5 seconds. Then, the device updates the last-5-second authentication and accounting statistics for the server.

·     History statistics—The device increases the history statistics for a RADIUS server by 1 each time it sends an authentication or accounting request to the server. The device does not decrease the history statistics even though users go offline or the server fails to response to a request within the timeout time.

Based on the statistics, you can adjust the load on RADIUS servers by changing the sequence in which the servers are configured or the weight values of the servers.

This command displays statistics only for RADIUS servers whose IP addresses are available or can be resolved from their hostnames.

The device deletes all statistics for a RADIUS server if the server is removed from a RADIUS scheme or the server's IP address, VPN instance, or service port number changes.

If an active/standby switchover occurs, the last-5-second statistics are deleted. However, the history statistics are not deleted. The history statistics might be inaccurate.

If the device reboots, both the last-5-seconds statistics and the history statistics are deleted.

Examples

# Display authentication and accounting load statistics for all RADIUS servers.

<Sysname> display radius server-load statistics

Authentication servers: 2

IP                   VPN              Port    Last 5 sec   History

1.1.1.1              N/A              1812    20           100

2.2.2.2              ABC              1812    0            20

Accounting servers: 2

IP                   VPN              Port    Last 5 sec   History

1.1.1.1              N/A              1813    20           100

2.2.2.2              ABC              1813    0            20

Table 5 Command output

Field

Description

Authentication servers

Total number of RADIUS authentication servers.

Accounting servers

Total number of RADIUS accounting servers.

IP

IP address of a RADIUS server.

VPN

MPLS L3VPN instance to which the RADIUS server belongs.

This field displays N/A if no VPN instance is specified for the server.

Port

Service port number of the RADIUS server.

Last 5 sec

Total number of RADIUS authentication or accounting requests sent to the RADIUS server within the last 5 seconds.

History

Total number of RADIUS authentication or accounting requests sent to the RADIUS server since the device starts up.

 

Related commands

reset radius server-load statistics

display radius statistics

Use display radius statistics to display RADIUS packet statistics.

Syntax

display radius statistics

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display RADIUS packet statistics.

<Sysname> display radius statistics

 

                                 Auth.         Acct.       SessCtrl.

          Request Packet:          0             0             0

            Retry Packet:          0             0             -

          Timeout Packet:          0             0             -

        Access Challenge:          0             -             -

           Account Start:          -             0             -

          Account Update:          -             0             -

            Account Stop:          -             0             -

       Terminate Request:          -             -             0

              Set Policy:          -             -             0

    Packet With Response:          0             0             0

 Packet Without Response:          0             0             -

          Access Rejects:          0             -             -

          Dropped Packet:          0             0             0

          Check Failures:          0             0             0

Table 6 Command output

Field

Description

Auth.

Authentication packets.

Acct.

Accounting packets.

SessCtrl.

Session-control packets.

Request Packet

Number of request packets.

Retry Packet

Number of retransmitted request packets.

Timeout Packet

Number of request packets timed out.

Access Challenge

Number of access challenge packets.

Account Start

Number of start-accounting packets.

Account Update

Number of accounting update packets.

Account Stop

Number of stop-accounting packets.

Terminate Request

Number of packets for logging off users forcibly.

Set Policy

Number of packets for updating user authorization information.

Packet With Response

Number of packets for which responses were received.

Packet Without Response

Number of packets for which no responses were received.

Access Rejects

Number of Access-Reject packets.

Dropped Packet

Number of discarded packets.

Check Failures

Number of packets with checksum errors.

 

Related commands

reset radius statistics

display stop-accounting-buffer (for RADIUS)

Use display stop-accounting-buffer to display information about buffered RADIUS stop-accounting requests to which no responses have been received.

Syntax

display stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time end-time | user-name user-name }

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

session-id session-id: Specifies a session by its ID. The session-id argument is a string of 1 to 64 characters and cannot contain a letter. A session ID uniquely identifies an online user for a RADIUS scheme.

time-range start-time end-time: Specifies a time range. The start time and end time must be in the format of hh:mm:ss-mm/dd/yyyy or hh:mm:ss-yyyy/mm/dd.

user-name user-name: Specifies a user by its name, a case-sensitive string of 1 to 255 characters. Whether the user-name argument should include the domain name depends on the setting configured by using the user-name-format command for the RADIUS scheme.

Examples

# Display information about nonresponded RADIUS stop-accounting requests buffered for user abc.

<Sysname> display stop-accounting-buffer user-name abc

Total entries: 2

Scheme     Session ID          Username    First sending time   Attempts

rad1       1000326232325010    abc         23:27:16-08/31/2015  19

aaa        1000326232326010    abc         23:33:01-08/31/2015  20

Table 7 Command output

Field

Description

Session ID

Session ID, which is the value of attribute Acct-Session-Id.

First sending time

Time when the stop-accounting request was first sent.

Attempts

Number of attempts that were made to send the stop-accounting request.

 

Related commands

reset stop-accounting-buffer (for RADIUS)

retry

retry stop-accounting (RADIUS scheme view)

stop-accounting-buffer enable (RADIUS scheme view)

user-name-format (RADIUS scheme view)

eap-profile

Use eap-profile to create an EAP profile and enter its view, or enter the view of an existing EAP profile.

Use undo eap-profile to delete an EAP profile.

Syntax

eap-profile eap-profile-name

undo eap-profile eap-profile-name

Default

No EAP profiles exist.

Views

System view

Predefined user roles

network-admin

Parameters

eap-profile-name: Specifies the EAP profile name, a case-sensitive string of 1 to 32 characters.

Usage guidelines

An EAP profile is a collection of EAP authentication settings, including the EAP authentication method and the CA certificate file to be used for some EAP authentication methods. You can use an EAP profile in a test profile for RADIUS server status detection.

You can specify an EAP profile in multiple test profiles.

You can configure a maximum of 16 EAP profiles.

Examples

# Create an EAP profile named eap1 and enter its view.

<Sysname> system-view

[Sysname] eap-profile eap1

[Sysname-eap-profile-eap1]

Related commands

radius-server test-profile

exclude

Use exclude to exclude an attribute from RADIUS requests.

Use undo exclude to cancel the configuration of excluding an attribute from RADIUS requests.

Syntax

exclude { accounting | authentication } name attribute-name

undo exclude { accounting | authentication } name attribute-name

Default

No attributes are configured to be excluded from RADIUS requests.

Views

RADIUS attribute test group view

Predefined user roles

network-admin

Parameters

accounting: Specifies RADIUS accounting requests.

authentication: Specifies RADIUS authentication requests.

name attribute-name: Specifies a RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters. The specified attribute must be an attribute that RADIUS requests carry by default. RADIUS authentication requests carry the following attributes by default: Service-Type, Framed-Protocol, NAS-Identifier, Acct-Session-Id, and NAS-Port-Type. RADIUS accounting requests carry the following attributes by default: NAS-Identifier, Acct-Delay-Time, Acct-Session-Id, and Acct-Terminate-Cause.

Usage guidelines

Use this command to exclude an attribute from RADIUS requests sent during an AAA test to help troubleshoot authentication or accounting failures.

Before you exclude an attribute that is already configured to be included in RADIUS requests, you must cancel the inclusion configuration by using the undo include command.

Examples

# In RADIUS attribute test group t1, exclude Service-Type attribute from RADIUS authentication requests.

<Sysname> system-view

[Sysname] radius attribute-test-group t1

[Sysname-radius-attr-test-grp-t1] exclude authentication name Service-Type

Related commands

include

test-aaa

include

Use include to include an attribute in RADIUS requests.

Use undo include to cancel the configuration of including an attribute in RADIUS requests.

Syntax

include { accounting | authentication } { name attribute-name | [ vendor vendor-id ] code attribute-code } type { binary | date | integer | interface-id | ip | ipv6 | ipv6-prefix | octets | string } value attribute-value

undo include { accounting | authentication} { name attribute-name | [ vendor vendor-id ] code attribute-code }

Default

No attributes are configured to be included in RADIUS authentication or accounting requests.

Views

RADIUS attribute test group view

Predefined user roles

network-admin

Parameters

accounting: Specifies RADIUS accounting requests.

authentication: Specifies RADIUS authentication requests.

name attribute-name: Specifies a standard RADIUS attribute by its name, a case-insensitive string of 1 to 63 characters.

vendor vendor-id: Specifies a vendor by its ID in the range of 1 to 65535. If the attribute is a standard RADIUS attribute, do not specify this option.

code attribute-code: Specifies a RADIUS attribute by its code in the range of 1 to 255.

type: Specifies a data type for the attribute content.

binary: Binary type.

date: Date type.

integer: Integer type.

interface-id: Interface ID type.

ip: IPv4 address type.

ipv6: IPv6 address type.

ipv6-prefix: IPv6 address prefix type.

octets: Octet type.

string: String type.

value attribute-value: Specifies the value for the attribute of the data type. The value range of the attribute-value argument varies by data type.

·     For the binary type, the value is a string of 1 to 256 hexadecimal characters, which represents a binary number with a maximum of 128 bytes.

·     For the date type, the value range is 0 to 4294967295.

·     For the integer type, the value range is 0 to 4294967295.

·     For the interface ID type, the value range is 1 to ffffffffffffffff.

·     For the IPv6 address prefix type, the value is in the format of prefix/prefix-length.

·     For the octet type, the value is a string of 1 to 256 hexadecimal characters, which represents an octet number with a maximum of 128 bytes.

·     For the string type, the value of this argument is a string of 1 to 253 characters.

Usage guidelines

Use this command to add an attribute that RADIUS requests do not carry by default to the RADIUS requests. The undo form of this command removes the attribute from the RADIUS requests.

For an attribute that RADIUS requests carry by default, you can use this command to change its value. The undo form of this command restores the attribute value to the default.

Table 8 shows the attributes that RADIUS requests carry by default.

Table 8 Attributes that RADIUS requests carry by default

Packet type

Attributes that the type of packets carry by default

RADIUS authentication request

User-Name, CHAP-Password (or User-Password), CHAP-Challenge, NAS-IP-Address (or NAS-IPv6-Address), Service-Type,Framed-Protocol, NAS-Identifier, NAS-Port-Type, and Acct-Session-Id.

RADIUS accounting request

User-Name, Acct-Status-Type, NAS-IP-Address (or NAS-IPv6-Address), NAS-Identifier, Acct-Session-Id, Acct-Delay-Time, and Acct-Terminate-Cause.

 

For the accuracy of AAA tests, the value of an attribute must be of the data type specified for that attribute.

The attribute names of standard attributes saved in the configuration file will be converted to attribute codes.

Before you include an attribute that is already configured to be excluded from RADIUS requests, you must cancel the exclusion configuration by using the undo exclude command.

Plan the RADIUS attributes to be included in RADIUS requests. Besides the attributes carried by default, the device adds the specified attributes to RADIUS packets in the order that they are specified by using the include command. Additional attributes cannot be added to a RADIUS request if the length of the RADIUS request reaches 4096 bytes.

Examples

# In RADIUS attribute test group t1, include Calling-Station-Id attribute with value 08-00-27-00-34-D8 in RADIUS authentication requests.

<Sysname> system-view

[Sysname] radius attribute-test-group t1

[Sysname-radius-attr-test-grp-t1] include authentication name Calling-Station-Id type string value 08-00-27-00-34-d8

Related commands

exclude

test-aaa

key (RADIUS scheme view)

Use key to set the shared key for secure RADIUS authentication or accounting communication.

Use undo key to delete the shared key for secure RADIUS authentication or accounting communication.

Syntax

key { accounting | authentication } { cipher | simple } string

undo key { accounting | authentication }

Default

No shared key is configured for secure RADIUS authentication or accounting communication.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

accounting: Specifies the shared key for secure RADIUS accounting communication.

authentication: Specifies the shared key for secure RADIUS authentication communication.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 117 characters. The plaintext form of the key is a string of 15 to 64 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

Usage guidelines

The shared keys configured by using this command apply to all servers in the scheme. Make sure the settings match the shared keys configured on the RADIUS servers.

The shared keys specified for specific RADIUS servers take precedence over the shared key specified with this command.

Examples

# In RADIUS scheme radius1, set the shared key to ok in plaintext form for secure accounting communication.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] key accounting simple ok

Related commands

display radius scheme

method

Use method to specify the EAP authentication method.

Use undo method to restore the default.

Syntax

method { md5 | peap-gtc | peap-mschapv2 | ttls-gtc | ttls-mschapv2 }

undo method

Default

MD5-challenge authentication is used.

Views

EAP profile view

Predefined user roles

network-admin

Parameters

md5: Specifies the MD5-challenge method.

peap-gtc: Specifies the PEAP-GTC method.

peap-mschapv2: Specifies the PEAP-MSCHAPv2 method.

ttls-gtc: Specifies the TTLS-GTC method.

ttls-mschapv2: Specifies the TTLS-MSCHAPv2 method.

Usage guidelines

You must specify an EAP authentication method that is supported by the RADIUS server to be detected.

You can specify only one EAP authentication method in an EAP profile. If you execute this command multiple times, the most recent configuration takes effect.

If you change the EAP authentication method, the new method takes effect in the next server status detection.

Examples

# In EAP profile eap1, specify PEAP-GTC as the EAP authentication method.

<Sysname> system-view

[Sysname] eap-profile eap1

[Sysname-eap-profile-eap1] method peap-gtc

nas-ip (RADIUS scheme view)

Use nas-ip to specify a source interface or source IP address for outgoing RADIUS packets.

Use undo nas-ip to delete the specified source interface or source IP address for outgoing RADIUS packets.

Syntax

nas-ip { ipv4-address | interface interface-type interface-number | ipv6 ipv6-address }

undo nas-ip [ interface | ipv6 ]

Default

The source IP address of an outgoing RADIUS packet is that specified by using the radius nas-ip command in system view.

If the radius nas-ip command is not used, the source IP address is the primary IP address of the outbound interface.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

interface interface-type interface-number: Specifies a source interface by its type and number. The device uses the primary IPv4 address or the IPv6 address of the interface as the source IP address of an outgoing RADIUS packet.

ipv4-address: Specifies an IPv4 address, which must be an address of the device. The IP address cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address.

ipv6 ipv6-address: Specifies an IPv6 address, which must be a unicast address of the device and cannot be a loopback address or a link-local address.

Usage guidelines

The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS that is configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a RADIUS packet, the RADIUS server checks the source IP address of the packet.

·     If the source IP address of the packet is the IP address of a managed NAS, the server processes the packet.

·     If the source IP address of the packet is not the IP address of a managed NAS, the server drops the packet.

As a best practice, specify a loopback interface address as the source IP address for outgoing RADIUS packets to avoid RADIUS packet loss caused by physical port errors.

If you use both the nas-ip command and radius nas-ip command, the following guidelines apply:

·     The setting configured by using the nas-ip command in RADIUS scheme view applies only to the RADIUS scheme.

·     The setting configured by using the radius nas-ip command in system view applies to all RADIUS schemes.

·     The setting in RADIUS scheme view takes precedence over the setting in system view.

For a RADIUS scheme, the following restrictions apply:

·     You can specify only one source IPv4 address and one source IPv6 address for outgoing RADIUS packets.

·     You can specify only one source interface to provide the source IP address for outgoing RADIUS packets. Make sure the route between the source interface and the RADIUS server is reachable.

·     The source interface configuration and the source IP address configuration overwrite each other.

If you do not specify any parameter for the undo nas-ip command, the command deletes the specified source IPv4 address for outgoing RADIUS packets.

Examples

# In RADIUS scheme radius1, specify IP address 10.1.1.1 as the source IP address for outgoing RADIUS packets.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] nas-ip 10.1.1.1

Related commands

display radius scheme

radius nas-ip

port

Use port to specify the RADIUS DAS port.

Use undo port to restore the default.

Syntax

port port-number

undo port

Default

The RADIUS DAS port number is 3799.

Views

RADIUS DAS view

Predefined user roles

network-admin

Parameters

port-number: Specifies a UDP port number in the range of 1 to 65535.

Usage guidelines

The destination port in DAE packets on the DAC must be the same as the RADIUS DAS port on the DAS.

Examples

# Enable the RADIUS DAS to listen to UDP port 3790 for DAE requests.

<Sysname> system-view

[Sysname] radius dynamic-author server

[Sysname-radius-da-server] port 3790

Related commands

client

radius dynamic-author server

primary accounting (RADIUS scheme view)

Use primary accounting to specify the primary RADIUS accounting server.

Use undo primary accounting to restore the default.

Syntax

primary accounting { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | vpn-instance vpn-instance-name | weight weight-value ] *

undo primary accounting

Default

The primary RADIUS accounting server is not specified.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

host-name: Specifies the host name of the primary RADIUS accounting server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies the IPv4 address of the primary RADIUS accounting server.

ipv6 ipv6-address: Specifies the IPv6 address of the primary RADIUS accounting server.

port-number: Specifies the service port number of the primary RADIUS accounting server. The value range for the UDP port number is 1 to 65535. The default setting is 1813.

key: Specifies the shared key for secure communication with the primary RADIUS accounting server.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 117 characters. The plaintext form of the key is a string of 15 to 64 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the primary RADIUS accounting server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

weight weight-value: Specifies a weight value for the RADIUS server. The value range for the weight-value argument is 0 to 100, and the default value is 0. The value 0 indicates that the RADIUS server will not be used for load sharing. This option takes effect only when the RADIUS server load sharing feature is enabled for the RADIUS scheme. A larger weight value represents a higher capacity to process accounting requests.

Usage guidelines

Make sure the port number and shared key settings of the primary RADIUS accounting server are the same as those configured on the server.

Two accounting servers specified for a scheme, primary or secondary, cannot have identical VPN instance, host name, IP address, and port number settings.

The shared key configured by using this command takes precedence over the shared key configured with the key accounting command.

If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the RADIUS scheme.

If you use the primary accounting command to modify or delete the primary accounting server to which the device is sending a start-accounting request, communication with the primary server times out.

·     When the RADIUS server load sharing feature is disabled, the device tries to communicate with an active server that has the highest priority for accounting.

·     When the RADIUS server load sharing feature is enabled, the device returns an accounting failure message rather than searching for another active accounting server.

If you remove an actively used accounting server, the device no longer sends users' real-time accounting requests and stop-accounting requests. It does not buffer the stop-accounting requests. The device can generate incorrect accounting results.

Examples

# In RADIUS scheme radius1, specify the primary accounting server with IP address 10.110.1.2, UDP port number 1813, and plaintext shared key 123456TESTacct&!.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] primary accounting 10.110.1.2 1813 key simple 123456TESTacct&!

Related commands

display radius scheme

key (RADIUS scheme view)

secondary accounting (RADIUS scheme view)

server-load-sharing enable

vpn-instance (RADIUS scheme view)

primary authentication (RADIUS scheme view)

Use primary authentication to specify the primary RADIUS authentication server.

Use undo primary authentication to restore the default.

Syntax

primary authentication { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | test-profile profile-name | vpn-instance vpn-instance-name | weight weight-value ] *

undo primary authentication

Default

The primary RADIUS authentication server is not specified.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

host-name: Specifies the host name of the primary RADIUS authentication server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies the IPv4 address of the primary RADIUS authentication server.

ipv6 ipv6-address: Specifies the IPv6 address of the primary RADIUS authentication server.

port-number: Specifies the service port number of the primary RADIUS authentication server. The value range for the UDP port number is 1 to 65535. The default setting is 1812.

key: Specifies the shared key for secure communication with the primary RADIUS authentication server.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 117 characters. The plaintext form of the key is a string of 15 to 64 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

test-profile profile-name: Specifies a test profile for detecting the RADIUS server status. The profile-name argument is a case-sensitive string of 1 to 31 characters.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the primary RADIUS authentication server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

weight weight-value: Specifies a weight value for the RADIUS server. The value range for the weight-value argument is 0 to 100, and the default value is 0. The value 0 indicates that the RADIUS server will not be used for load sharing. This option takes effect only when the RADIUS server load sharing feature is enabled for the RADIUS scheme. A larger weight value represents a higher capacity to process authentication requests.

Usage guidelines

Make sure the service port and shared key settings of the primary RADIUS authentication server are the same as those configured on the server.

Two authentication servers specified for a scheme, primary or secondary, cannot have identical VPN instance, host name, IP address, and port number settings.

The shared key configured by this command takes precedence over the shared key configured with the key authentication command.

The server status detection is triggered for the server if the specified test profile exists on the device.

If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the RADIUS scheme.

If you use the primary authentication command to modify or delete the primary authentication server during an authentication process, communication with the primary server times out.

·     When the RADIUS server load sharing feature is disabled, the device tries to communicate with an active server that has the highest priority for authentication.

·     When the RADIUS server load sharing feature is enabled, the device performs the following operations:

a.     Checks the weight value and number of currently served users for each active server.

b.     Determines the most appropriate server in performance to receive an AAA request.

Examples

# In RADIUS scheme radius1, specify the primary authentication server with IP address 10.110.1.1, UDP port number 1812, and plaintext shared key 123456TESTauth&!.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] primary authentication 10.110.1.1 1812 key simple 123456TESTauth&!

Related commands

display radius scheme

key (RADIUS scheme view)

radius-server test-profile

secondary authentication (RADIUS scheme view)

server-load-sharing enable

vpn-instance (RADIUS scheme view)

radius attribute extended

Use radius attribute extended to define an extended RADIUS attribute.

Use undo radius attribute extended to delete user-defined extended RADIUS attributes.

Syntax

radius attribute extended attribute-name [ vendor vendor-id ] code attribute-code type { binary | date | integer | interface-id | ip | ipv6 | ipv6-prefix | octets | string }

undo radius attribute extended [ attribute-name ]

Default

No user-defined extended RADIUS attributes exist.

Views

System view

Predefined user roles

network-admin

Parameters

attribute-name: Specifies the RADIUS attribute name, a case-insensitive string of 1 to 63 characters. The name must be unique among all RADIUS attributes, including the standard and extended RADIUS attributes.

vendor vendor-id: Specifies a vendor ID in the range of 1 to 65535. If you do not specify a vendor ID, the device processes the RADIUS attribute as a standard RADIUS attribute.

code attribute-code: Specifies the ID of the RADIUS attribute in the attribute set. The value range for the attribute-code argument is 1 to 255.

type: Specifies a data type for the attribute content.

binary: Binary type.

date: Date type.

integer: Integer type.

interface-id: Interface ID type.

ip: IPv4 address type.

ipv6: IPv6 address type.

ipv6-prefix: IPv6 address prefix type.

octets: Octet type.

string: String type.

Usage guidelines

To support the proprietary RADIUS attributes of other vendors, perform the following tasks:

1.     Use this command to define the attributes as extended RADIUS attributes.

2.     Use the attribute convert command to map the extended RADIUS attributes to attributes supported by the system.

3.     Use the attribute translate command to enable the RADIUS attribute translation feature for the mappings to take effect.

To cooperate with RADIUS servers of a third-party vendor, map attributes that cannot be identified by the server to server-supported attributes.

Two RADIUS attributes cannot have the same combination of attribute name, vendor ID, and attribute ID.

If you do not specify a RADIUS attribute name, the undo radius attribute extended command deletes all user-defined extended RADIUS attributes.

Examples

# Define a string-type extended RADIUS attribute with attribute name Owner-Password, vendor ID 122, and attribute ID 80.

<Sysname> system-view

[Sysname] radius attribute extended Owner-Password vendor 122 code 80 type string

Related commands

attribute convert (RADIUS DAS view)

attribute convert (RADIUS scheme view)

attribute reject (RADIUS DAS view)

attribute reject (RADIUS scheme view)

attribute translate

radius attribute-test-group

Use radius attribute-test-group to create a RADIUS attribute test group and enter its view, or enter the view of an existing RADIUS attribute test group.

Use undo radius attribute-test-group to remove a RADIUS attribute test group.

Syntax

radius attribute-test-group attr-test-group-name

undo radius attribute-test-group attr-test-group-name

Default

No RADIUS attribute test groups exist.

Views

System view

Predefined user roles

network-admin

Parameters

attr-test-group-name: Specifies the name of a RADIUS attribute test group, a case-insensitive string of 1 to 31 characters.

Usage guidelines

A RADIUS attribute test group is a collection of RADIUS attributes that will be included in or excluded from RADIUS requests.

The system can have multiple RADIUS attribute test groups.

Examples

# Create a RADIUS attribute test group named t1 and enter its view.

<Sysname> system-view

[Sysname] radius attribute-test-group t1

[Sysname-radius-attr-test-grp-t1]

Related commands

exclude

include

test-aaa

radius dscp

Use radius dscp to change the DSCP priority of RADIUS packets.

Use undo radius dscp to restore the default.

Syntax

radius [ ipv6 ] dscp dscp-value

undo radius [ ipv6 ] dscp

Default

The DSCP priority of RADIUS packets is 0.

Views

System view

Predefined user roles

network-admin

Parameters

ipv6: Specifies the IPv6 RADIUS packets. If you do not specify this keyword, the command sets the DSCP priority for the IPv4 RADIUS packets.

dscp-value: Specifies the DSCP priority of RADIUS packets, in the range of 0 to 63. A larger value represents a higher priority.

Usage guidelines

Use this command to set the DSCP priority in the ToS field of RADIUS packets for changing their transmission priority.

Examples

# Set the DSCP priority of IPv4 RADIUS packets to 10.

<Sysname> system-view

[Sysname] radius dscp 10

radius dynamic-author server

Use radius dynamic-author server to enable the RADIUS DAS feature and enter RADIUS DAS view.

Use undo radius dynamic-author server to disable the RADIUS DAS feature.

Syntax

radius dynamic-author server

undo radius dynamic-author server

Default

The RADIUS DAS feature is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

After you enable the RADIUS DAS feature, the device listens to the RADIUS DAS port to receive DAE packets from specified DACs. Based on the DAE packet type and contents, the device performs one of the following operations:

·     Log off online users.

·     Change online user authorization information.

·     Shut down or reboot online users' access ports.

·     Reauthenticate online users.

Examples

# Enable the RADIUS DAS feature and enter RADIUS DAS view.

<Sysname> system-view

[Sysname] radius dynamic-author server

[Sysname-radius-da-server]

Related commands

client

port

radius enable

Use radius enable to enable the RADIUS service.

Use undo radius enable to disable the RADIUS service.

Syntax

radius enable

undo radius enable

Default

The RADIUS service is enabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

By default, the RADIUS service is enabled. The device can send and receive RADIUS packets. Attackers might use RADIUS session-control and DAE ports to attack the device. To protect the device when such an attack occurs, disable the RADIUS service temporarily on the device. After the network is secure, re-enable the RADIUS service.

If settings on the RADIUS servers require modification or the RADIUS servers cannot provide services temporarily, you can temporarily disable the RADIUS service on the device.

When the RADIUS service is disabled, the device stops sending and receiving RADIUS packets. If a new user comes online, the device uses the backup authentication, authorization, or accounting method to process that user. If the device has not finished requesting authentication or accounting for a user before the RADIUS service is disabled, it uses the following rules to process that user:

·     If the device has sent RADIUS authentication requests for that user to a RADIUS server, the device processes that user depending on whether it receives a response from the RADIUS server.

¡     If the device receives a response from the RADIUS server, it uses the response to determine whether that user has passed authentication. If that user has passed authentication, the device assigns authorization information to that user according to the response.

¡     If the device does not receive any response from the RADIUS server, it attempts to use the backup authentication method to authenticate that user.

·     If the device has sent RADIUS start-accounting requests for that user to a RADIUS server, the device processes that user depending on whether it receives a response from the RADIUS server.

¡     If the device receives a response from the RADIUS server, it allows that user to come online. However, the device cannot send out accounting-update or stop-accounting requests to the RADIUS server. It cannot buffer the accounting requests, either. When that user goes offline, the RADIUS server cannot log off that user in time. The accounting result might be inaccurate.

¡     If the device does not receive any response from the RADIUS server, it attempts to use the backup accounting method.

Disabling the RADIUS service does not affect the RADIUS server feature of the device.

The authentication, authorization, and accounting processes undertaken by other methods are not switched to RADIUS when you re-enable the RADIUS service.

Examples

# Enable the RADIUS service.

<Sysname> system-view

[Sysname] radius enable

radius nas-ip

Use radius nas-ip to specify a source interface or source IP address for outgoing RADIUS packets.

Use undo radius nas-ip to delete the specified source interface or source IP address for outgoing RADIUS packets.

Syntax

radius nas-ip { interface interface-type interface-number | { ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] }

undo radius nas-ip { interface | { ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] }

Default

The source IP address of an outgoing RADIUS packet is the primary IPv4 address or the IPv6 address of the outbound interface.

Views

System view

Predefined user roles

network-admin

Parameters

interface interface-type interface-number: Specifies a source interface by its type and number. The device uses the primary IPv4 address or the IPv6 address of the interface as the source IP address of an outgoing RADIUS packet.

ipv4-address: Specifies an IPv4 address, which must be an address of the device. The IP address cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address.

ipv6 ipv6-address: Specifies an IPv6 address, which must be a unicast address of the device and cannot be a loopback address or a link-local address.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the source IP address belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. To configure a public-network source IP address, do not specify this option.

Usage guidelines

The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS that is configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a RADIUS packet, the RADIUS server checks the source IP address of the packet.

·     If the source IP address of the packet is the IP address of a managed NAS, the server processes the packet.

·     If the source IP address of the packet is not the IP address of a managed NAS, the server drops the packet.

As a best practice, specify a loopback interface address as the source IP address for outgoing RADIUS packets to avoid RADIUS packet loss caused by physical port errors.

If you use both the nas-ip command and radius nas-ip command, the following guidelines apply:

·     The setting configured by using the nas-ip command in RADIUS scheme view applies only to the RADIUS scheme.

·     The setting configured by using the radius nas-ip command in system view applies to all RADIUS schemes.

·     The setting in RADIUS scheme view takes precedence over the setting in system view.

You can specify a maximum of 16 source IP addresses in system view, including:

·     Zero or one public-network source IPv4 address.

·     Zero or one public-network source IPv6 address.

·     Private-network source IP addresses.

Each VPN instance can have only one private-network source IPv4 address and one private-network source IPv6 address in system view.

You can specify only one source interface to provide the source IP address for outgoing RADIUS packets. Make sure the route between the source interface and the RADIUS server is reachable.

The source interface configuration and the source IP address configuration overwrite each other.

Examples

# Specify IP address 129.10.10.1 as the source IP address for outgoing RADIUS packets.

<Sysname> system-view

[Sysname] radius nas-ip 129.10.10.1

Related commands

nas-ip (RADIUS scheme view)

radius scheme

Use radius scheme to create a RADIUS scheme and enter its view, or enter the view of an existing RADIUS scheme.

Use undo radius scheme to delete a RADIUS scheme.

Syntax

radius scheme radius-scheme-name

undo radius scheme radius-scheme-name

Default

No RADIUS schemes exist.

Views

System view

Predefined user roles

network-admin

Parameters

radius-scheme-name: Specifies the RADIUS scheme name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

A RADIUS scheme can be used by more than one ISP domain at the same time.

The device supports a maximum of 16 RADIUS schemes.

Examples

# Create a RADIUS scheme named radius1 and enter RADIUS scheme view.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1]

Related commands

display radius scheme

radius session-control client

Use radius session-control client to specify a RADIUS session-control client.

Use undo radius session-control client to remove the specified RADIUS session-control clients.

Syntax

radius session-control client { ip ipv4-address | ipv6 ipv6-address } [ key { cipher | simple } string | vpn-instance vpn-instance-name ] *

undo radius session-control client { all | { ip ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] }

Default

No RADIUS session-control clients are specified.

Views

System view

Predefined user roles

network-admin

Parameters

ip ipv4-address: Specifies a session-control client by its IPv4 address.

ipv6 ipv6-address: Specifies a session-control client by its IPv6 address.

key: Specifies the shared key for secure communication with the session-control client.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 117 characters. The plaintext form of the key is a string of 15 to 64 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the RADIUS session-control client belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the client is on the public network, do not specify this option.

all: Specifies all session-control clients.

Usage guidelines

To verify the session-control packets sent from a RADIUS server running on IMC, specify the RADIUS server as a session-control client to the device. The device matches a session-control packet to a session-control client based on the IP address and VPN instance, and then uses the shared key of the matched client to validate the packet.

The device searches the session-control client settings prior to searching all RADIUS scheme settings for a server with matching settings. This process narrows the search scope for finding the matched RADIUS server.

The session-control client settings take effect only when the RADIUS session-control feature is enabled.

The session-control client settings must be the same as the corresponding settings of the RADIUS server.

You can specify multiple session-control clients on the device.

Examples

# Specify a session-control client with IP address 10.110.1.2 and shared key 12345 in plaintext form.

<Sysname> system-view

[Sysname] radius session-control client ip 10.110.1.2 key simple 12345

Related commands

radius session-control enable

radius session-control enable

Use radius session-control enable to enable the RADIUS session-control feature.

Use undo radius session-control enable to disable the RADIUS session-control feature.

Syntax

radius session-control enable

undo radius session-control enable

Default

The RADIUS session-control feature is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

An H3C IMC RADIUS server uses session-control packets to deliver dynamic authorization change requests or disconnection requests to the device. The session-control feature enables the device to receive the RADIUS session-control packets on UDP port 1812.

This feature must work with H3C IMC servers.

Examples

# Enable the RADIUS session-control feature.

<Sysname> system-view

[Sysname] radius session-control enable

radius trap-version

Use radius trap-version to set the version of RADIUS server status change MIB nodes.

Use undo radius trap-version to restore the default.

Syntax

radius trap-version { v1 | v2 } [ accounting-server-down | accounting-server-up | authentication-server-down | authentication-server-up ] *

undo radius trap-version { v1 | v2 } [ accounting-server-down | accounting-server-up | authentication-server-down | authentication-server-up ] *

Default

The device sends notifications about RADIUS server status change MIB nodes over SNMPv1.

Views

System view

Predefined user roles

network-admin

Parameters

v1: Specifies SNMPv1.

v2: Specifies SNMPv2.

accounting-server-down: Specifies the MIB node of RADIUS accounting server down notifications.

accounting-server-up: Specifies the MIB node of RADIUS accounting server up notifications.

authentication-server-down: Specifies the MIB node of RADIUS authentication server down notifications.

authentication-server-up: Specifies the MIB node of RADIUS authentication server up notifications.

Usage guidelines

Make sure the RADIUS server status change notifications sent by the device can be recognized by the NMS. Choose a MIB node version depending on the NMS requirements.

Table 9 RADIUS server status change MIB nodes (SNMPv1)

MIB node

OID

hh3cRadiusAuthServerUpTrap

1.3.6.1.4.1.25506.2.13.3.0.1

hh3cRadiusAccServerUpTrap

1.3.6.1.4.1.25506.2.13.3.0.2

hh3cRadiusAuthServerDownTrap

1.3.6.1.4.1.25506.2.13.3.1

hh3cRadiusAccServerDownTrap

1.3.6.1.4.1.25506.2.13.3.2

 

Table 10 RADIUS server status change MIB nodes (SNMPv2)

MIB node

OID

hh3cRadiusAuthenticationServerUpTrap

1.3.6.1.4.1.25506.2.13.3.0.4

hh3cRadiusAccountingServerUpTrap

1.3.6.1.4.1.25506.2.13.3.0.5

hh3cRadiusAuthenticationServerDownTrap

1.3.6.1.4.1.25506.2.13.3.0.6

hh3cRadiusAccountingServerDownTrap

1.3.6.1.4.1.25506.2.13.3.0.7

 

If you do not specify any RADIUS server status change MIB nodes, this command sets a version for all types of RADIUS server status change MIB nodes.

If you execute this command multiple times, the most recent configuration takes effect.

Examples

# Set the MIB node version to SNMPv2 for the MIB node of RADIUS accounting server down notifications.

<Sysname> system-view

[Sysname] radius trap-version v2 accounting-server-down

Related commands

snmp-agent trap enable radius

radius-server test-profile

Use radius-server test-profile to configure a test profile for detecting the RADIUS server status.

Use undo radius-server test-profile to delete a RADIUS test profile.

Syntax

radius-server test-profile profile-name username name [ password { cipher | simple } string ] [ interval interval ] [ eap-profile eap-profile-name ]

undo radius-server test-profile profile-name

Default

No RADIUS test profiles exist.

Views

System view

Predefined user roles

network-admin

Parameters

profile-name: Specifies the name of the test profile, which is a case-sensitive string of 1 to 31 characters.

username name: Specifies the username in the detection packets. The name argument is a case-sensitive string of 1 to 253 characters.

password: Specifies the user password in the detection packets. If you do not specify a user password, the device randomly generates a user password for each detection packet. As a best practice, specify a user password. RADIUS server might mistake detection packets that contain randomly generated passwords as attack packets.

cipher: Specifies a password in encrypted form.

simple: Specifies a password in plaintext form. For security purposes, the password specified in plaintext form will be stored in encrypted form.

string: Specifies the password. Its plaintext form is a case-sensitive string of 1 to 63 characters. Its encrypted form is a case-sensitive string of 1 to 117 characters.

interval interval: Specifies the interval for sending a detection packet, in minutes. The value range for the interval argument is 1 to 3600, and the default value is 60.

eap-profile eap-profile-name: Specifies an EAP profile by its name, a case-sensitive string of 1 to 32 characters.

Usage guidelines

The device starts detecting the status of a RADIUS server only if the test profile specified for the server exists. If you specify a nonexistent test profile for a RADIUS server, the device does not detect the status of the server until you create the test profile on the device.

To perform EAP-based status detection for a RADIUS server, you must specify a test profile that contains an EAP profile for the RADIUS server.

EAP-based detection provides more reliable detection results than simple detection. As a best practice, configure EAP-based detection on a network environment where EAP authentication is configured.

If you specify a nonexistent EAP profile in a test profile, the device performs simple detection for the RADIUS servers that use the test profile. After the EAP profile is configured, the device will start EAP-based detection at the next detection interval.

When you delete a test profile, the device stops detecting the status of RADIUS servers that use the test profile.

You can execute this command multiple times to configure multiple test profiles.

Examples

# Configure a test profile named abc for RADIUS server status detection. A detection packet that uses username admin and plaintext password abc123 is sent every 10 minutes.

<Sysname> system-view

[Sysname] radius-server test-profile abc username admin password simple abc123 interval 10

Related commands

eap-profile

primary authentication (RADIUS scheme view)

secondary authentication (RADIUS scheme view)

reauthentication server-select

Use reauthentication server-select to specify a RADIUS server selection mode for reauthentication.

Use undo reauthentication server-select to restore the default.

Syntax

reauthentication server-select { inherit | reselect }

undo reauthentication server-select

Default

The inherit mode is used.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

inherit: Uses the RADIUS server that performed authentication for reauthentication.

reselect: Reselects a RADIUS server for reauthentication.

Usage guidelines

Use this command to configure the RADIUS server selection mechanism in reauthentication. Use one of the following modes depending on the network condition:

·     Inherit—The device uses the RADIUS server that performed authentication for a user to reauthenticate that user. This mode reduces the amount of time used in reauthentication. However, if the RADIUS server is unreachable, the reauthentication will fail.

·     Reselect—The device searches for a reachable RADIUS server to reauthenticate a user. This mode requires more time than the inherit mode. However, this mode ensures that the device uses the optimal reachable RADIUS server for reauthentication. The following factors affect the RADIUS server selection:

¡     Server configuration in the RADIUS scheme, including the configuration order.

¡     Enabling status of the RADIUS server load sharing feature.

¡     Status of the RADIUS servers in the RADIUS scheme.

Examples

# In RADIUS scheme radius1, set the RADIUS server selection mode to reselect for reauthentication.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] reauthentication server-select reselect

Related commands

display radius scheme

reset radius server-load statistics

Use reset radius server-load statistics to clear history authentication and accounting load statistics for all RADIUS servers.

Syntax

reset radius server-load statistics

Views

User view

Predefined user roles

network-admin

Usage guidelines

This command does not clear authentication and accounting load statistics in the last 5 seconds.

Examples

# Clear history authentication and accounting load statistics for all RADIUS servers.

<Sysname> reset radius server-load statistics

Related commands

display radius server-load statistics

reset radius statistics

Use reset radius statistics to clear RADIUS statistics.

Syntax

reset radius statistics

Views

User view

Predefined user roles

network-admin

Examples

# Clear RADIUS statistics.

<Sysname> reset radius statistics

Related commands

display radius statistics

reset stop-accounting-buffer (for RADIUS)

Use reset stop-accounting-buffer to clear buffered RADIUS stop-accounting requests to which no responses have been received.

Syntax

reset stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time end-time | user-name user-name }

Views

User view

Predefined user roles

network-admin

Parameters

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

session-id session-id: Specifies a session by its ID. The session-id argument is a string of 1 to 64 characters and cannot contain a letter. A session ID uniquely identifies an online user for a RADIUS scheme.

time-range start-time end-time: Specifies a time range. The start time and end time must be in the format of hh:mm:ss-mm/dd/yyyy or hh:mm:ss-yyyy/mm/dd.

user-name user-name: Specifies a user by its name, a case-sensitive string of 1 to 255 characters. Whether the user-name argument should include the domain name depends on the setting configured by using the user-name-format command for the RADIUS scheme.

Examples

# Clear nonresponded RADIUS stop-accounting requests buffered for user user0001@test.

<Sysname> reset stop-accounting-buffer user-name user0001@test

# Clear nonresponded RADIUS stop-accounting requests buffered from 0:0:0 to 23:59:59 on August 31, 2015.

<Sysname> reset stop-accounting-buffer time-range 0:0:0-08/31/2015 23:59:59-08/31/2015

Related commands

display stop-accounting-buffer (for RADIUS)

stop-accounting-buffer enable (RADIUS scheme view)

retry

Use retry to set the maximum number of attempts for transmitting a RADIUS packet to a single RADIUS server.

Use undo retry to restore the default.

Syntax

retry retries

undo retry

Default

The maximum number of RADIUS packet transmission attempts is 3.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

retries: Specifies the maximum number of RADIUS packet transmission attempts, in the range of 1 to 20.

Usage guidelines

Because RADIUS uses UDP packets to transmit data, the communication is not reliable.

If the device does not receive a response to its request from the RADIUS server within the response timeout period, the device retransmits the RADIUS request. To set the response timeout period, use the timer response-timeout command.

If the device does not receive a response from the RADIUS server after the maximum number of transmission attempts is reached, the device considers the request a failure.

If the client times out during the authentication process, the user is immediately logged off. To avoid user logoffs, the value multiplied by the following items cannot be larger than the client timeout period defined by the access module:

·     The maximum number of RADIUS packet transmission attempts.

·     The RADIUS server response timeout period.

·     The number of RADIUS authentication servers in the RADIUS scheme.

When the device sends a RADIUS request to a new RADIUS server, it checks the total amount of time it has taken to transmit the RADIUS packet. If the amount of time has reached 300 seconds, the device stops sending the RADIUS request to the next RADIUS server. As a best practice, consider the number of RADIUS servers when you configure the maximum number of packet transmission attempts and the RADIUS server response timeout period.

Examples

# In RADIUS scheme radius1, set the maximum number of RADIUS packet transmission attempts to 5.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] retry 5

Related commands

radius scheme

timer response-timeout (RADIUS scheme view)

retry realtime-accounting

Use retry realtime-accounting to set the maximum number of accounting attempts.

Use undo retry realtime-accounting to restore the default.

Syntax

retry realtime-accounting retries

undo retry realtime-accounting

Default

The maximum number of accounting attempts is 5.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

retries: Specifies the maximum number of accounting attempts, in the range of 1 to 255.

Usage guidelines

Typically, a RADIUS accounting server checks whether a user is online by using a timeout timer. If the server does not receive a real-time accounting request for a user in the timeout period, it considers that a line or device failure has occurred. The server stops accounting for the user.

To work with the RADIUS server, the NAS needs to send real-time accounting requests to the server before the timer on the server expires and to keep pace with the server in disconnecting the user when a failure occurs. The NAS disconnects from a user according to the maximum number of accounting attempts and specific parameters.

For example, the following conditions exist:

·     The RADIUS server response timeout period is 3 seconds (set by using the timer response-timeout command).

·     The maximum number of RADIUS packet transmission attempts is 3 (set by using the retry command).

·     The real-time accounting interval is 12 minutes (set by using the timer realtime-accounting command).

·     The maximum number of accounting attempts is 5 (set by using the retry realtime-accounting command).

In the above case, the device generates an accounting request every 12 minutes, and retransmits the request if it sends the request but receives no response within 3 seconds. If the device receives no response after transmitting the request three times, it considers the accounting attempt a failure, and makes another accounting attempt. If five consecutive accounting attempts fail, the device cuts the user connection.

Examples

# In RADIUS scheme radius1, set the maximum number of accounting attempts to 10.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] retry realtime-accounting 10

Related commands

retry

timer realtime-accounting (RADIUS scheme view)

timer response-timeout (RADIUS scheme view)

retry stop-accounting (RADIUS scheme view)

Use retry stop-accounting to set the maximum number of transmission attempts for individual RADIUS stop-accounting requests.

Use undo retry stop-accounting to restore the default.

Syntax

retry stop-accounting retries

undo retry stop-accounting

Default

The maximum number of transmission attempts is 500 for individual RADIUS stop-accounting requests.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

retries: Specifies the maximum number of transmission attempts. The value range is 10 to 65535.

Usage guidelines

The maximum number of stop-accounting request transmission attempts controls the transmission of stop-accounting requests together with the following parameters:

·     RADIUS server response timeout timer (set by using the timer response-timeout command).

·     Maximum number of times to transmit a RADIUS packet per round (set by using the retry command).

For example, the following settings exist:

·     The RADIUS server response timeout timer is 3 seconds.

·     The maximum number of times to transmit a RADIUS packet per round is five.

·     The maximum number of stop-accounting request transmission attempts is 20.

A stop-accounting request is retransmitted if the device does not receive a response within 3 seconds. When all five transmission attempts in this round are used, the device buffers the request and starts another round of retransmission. If 20 consecutive rounds of attempts fail, the device discards the request.

Examples

# Set the maximum number of stop-accounting request transmission attempts to 1000 for RADIUS scheme radius1.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] retry stop-accounting 1000

Related commands

display stop-accounting-buffer (for RADIUS)

retry

timer response-timeout (RADIUS scheme view)

secondary accounting (RADIUS scheme view)

Use secondary accounting to specify a secondary RADIUS accounting server.

Use undo secondary accounting to remove a secondary RADIUS accounting server.

Syntax

secondary accounting { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | vpn-instance vpn-instance-name | weight weight-value ] *

undo secondary accounting [ { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ]

Default

No secondary RADIUS accounting servers are specified.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

host-name: Specifies the host name of a secondary RADIUS accounting server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies the IPv4 address of a secondary RADIUS accounting server.

ipv6 ipv6-address: Specifies the IPv6 address of a secondary RADIUS accounting server.

port-number: Specifies the service port number of the secondary RADIUS accounting server. The value range for the UDP port number is 1 to 65535. The default setting is 1813.

key: Specifies the shared key for secure communication with the secondary RADIUS accounting server.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 117 characters. The plaintext form of the key is a string of 15 to 64 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary RADIUS accounting server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

weight weight-value: Specifies a weight value for the RADIUS server. The value range for the weight-value argument is 0 to 100, and the default value is 0. The value 0 indicates that the RADIUS server will not be used for load sharing. This option takes effect only when the RADIUS server load sharing feature is enabled for the RADIUS scheme. A larger weight value represents a higher capacity to process accounting requests.

Usage guidelines

Make sure the port number and shared key settings of each secondary RADIUS accounting server are the same as those configured on the corresponding server.

A RADIUS scheme supports a maximum of 16 secondary RADIUS accounting servers. If the primary server fails, the device tries to communicate with a secondary server in active state. The device connects to the secondary servers in the order they are configured.

Two accounting servers specified for a scheme, primary or secondary, cannot have identical VPN instance, host name, IP address, and port number settings.

The shared key configured by this command takes precedence over the shared key configured with the key accounting command.

If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the RADIUS scheme.

If you use the secondary accounting command to modify or delete a secondary accounting server to which the device is sending a start-accounting request, communication with the secondary server times out.

·     When the RADIUS server load sharing feature is disabled, the device tries to communicate with an active server that has the highest priority for accounting.

·     When the RADIUS server load sharing feature is enabled, the device returns an accounting failure message rather than searching for another active accounting server.

If you remove an actively used accounting server, the device no longer sends users' real-time accounting requests and stop-accounting requests. The device does not buffer the stop-accounting requests, either.

Examples

# In RADIUS scheme radius1, specify a secondary accounting server with IP address 10.110.1.1 and UDP port 1813.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] secondary accounting 10.110.1.1 1813

# In RADIUS scheme radius2, specify two secondary accounting servers with IP addresses 10.110.1.1 and 10.110.1.2 and UDP port 1813.

<Sysname> system-view

[Sysname] radius scheme radius2

[Sysname-radius-radius2] secondary accounting 10.110.1.1 1813

[Sysname-radius-radius2] secondary accounting 10.110.1.2 1813

Related commands

display radius scheme

key (RADIUS scheme view)

primary accounting (RADIUS scheme view)

vpn-instance (RADIUS scheme view)

secondary authentication (RADIUS scheme view)

Use secondary authentication to specify a secondary RADIUS authentication server.

Use undo secondary authentication to remove a secondary RADIUS authentication server.

Syntax

secondary authentication { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | test-profile profile-name | vpn-instance vpn-instance-name | weight weight-value ] *

undo secondary authentication [ { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ]

Default

No secondary RADIUS authentication servers are specified.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

host-name: Specifies the host name of a secondary RADIUS authentication server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies the IPv4 address of a secondary RADIUS authentication server.

ipv6 ipv6-address: Specifies the IPv6 address of a secondary RADIUS authentication server.

port-number: Specifies the service port number of the secondary RADIUS authentication server. The value range for the UDP port number is 1 to 65535. The default setting is 1812.

key: Specifies the shared key for secure communication with the secondary RADIUS authentication server.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 117 characters. The plaintext form of the key is a string of 15 to 64 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

test-profile profile-name: Specifies a test profile for detecting the RADIUS server status. The profile-name argument is a case-sensitive string of 1 to 31 characters.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary RADIUS authentication server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

weight weight-value: Specifies a weight value for the RADIUS server. The value range for the weight-value argument is 0 to 100, and the default value is 0. The value 0 indicates that the RADIUS server will not be used for load sharing. This option takes effect only when the RADIUS server load sharing feature is enabled for the RADIUS scheme. A larger weight value represents a higher capacity to process authentication requests.

Usage guidelines

Make sure the port number and shared key settings of each secondary RADIUS authentication server are the same as those configured on the corresponding server.

A RADIUS scheme supports a maximum of 16 secondary RADIUS authentication servers. If the primary server fails, the device tries to communicate with a secondary server in active state. The device connects to the secondary servers in the order they are configured.

The server status detection is triggered for a server if the specified test profile exists on the device.

Two authentication servers specified for a scheme, primary or secondary, cannot have identical VPN instance, host name, IP address, and port number settings.

The shared key configured by this command takes precedence over the shared key configured with the key authentication command.

If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the RADIUS scheme.

If you use the secondary authentication command to modify or delete a secondary authentication server during an authentication process, communication with the secondary server times out.

·     When the RADIUS server load sharing feature is disabled, the device tries to communicate with an active server that has the highest priority for authentication.

·     When the RADIUS server load sharing feature is enabled, the device performs the following operations:

a.     Checks the weight value and number of currently served users for each active server.

b.     Determines the most appropriate server in performance to receive an AAA request.

Examples

# In RADIUS scheme radius1, specify a secondary authentication server with IP address 10.110.1.2 and UDP port 1812.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] secondary authentication 10.110.1.2 1812

# In RADIUS scheme radius2, specify two secondary authentication servers with IP addresses 10.110.1.1 and 10.110.1.2 and UDP port 1812.

<Sysname> system-view

[Sysname] radius scheme radius2

[Sysname-radius-radius2] secondary authentication 10.110.1.1 1812

[Sysname-radius-radius2] secondary authentication 10.110.1.2 1812

Related commands

display radius scheme

key (RADIUS scheme view)

primary authentication (RADIUS scheme view)

radius-server test-profile

vpn-instance (RADIUS scheme view)

server-load-sharing enable

Use server-load-sharing enable to enable the RADIUS server load sharing feature.

Use undo server-load-sharing enable to disable the RADIUS server load sharing feature.

Syntax

server-load-sharing enable

undo server-load-sharing enable

Default

The RADIUS server load sharing feature is disabled.

Views

RADIUS scheme view

Predefined user roles

network-admin

Usage guidelines

Use the RADIUS server load sharing feature to dynamically distribute the workload over multiple servers regardless of their server roles. The device forwards an AAA request to the most appropriate server of all active servers in the scheme after it compares the weight values and numbers of currently served users. Specify a weight value for each RADIUS server based on the AAA capacity of the server. A larger weight value indicates a higher AAA capacity.

In RADIUS server load sharing, once the device sends a start-accounting request to a server for a user, it forwards all subsequent accounting requests of the user to the same server. If the accounting server is unreachable, the device returns an accounting failure message rather than searching for another active accounting server.

Examples

# Enable the RADIUS server load sharing feature for RADIUS scheme radius1.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] server-load-sharing enable

Related commands

primary authentication (RADIUS scheme view)

primary accounting (RADIUS scheme view)

secondary authentication (RADIUS scheme view)

secondary accounting (RADIUS scheme view)

snmp-agent trap enable radius

Use snmp-agent trap enable radius to enable SNMP notifications for RADIUS.

Use undo snmp-agent trap enable radius to disable SNMP notifications for RADIUS.

Syntax

snmp-agent trap enable radius [ accounting-server-down | accounting-server-up | authentication-error-threshold | authentication-server-down | authentication-server-up ] *

undo snmp-agent trap enable radius [ accounting-server-down | accounting-server-up | authentication-error-threshold | authentication-server-down | authentication-server-up ] *

Default

All RADIUS SNMP notifications are disabled.

Views

System view

Predefined user roles

network-admin

Parameters

accounting-server-down: Specifies notifications to be sent when the RADIUS accounting server becomes unreachable.

accounting-server-up: Specifies notifications to be sent when the RADIUS accounting server becomes reachable.

authentication-error-threshold: Specifies notifications to be sent when the number of authentication failures exceeds the specified threshold. The threshold is represented by the ratio of the authentication failures to the total number of authentication attempts. The value range is 1 to 100, and the default value is 30. This threshold can only be configured through the MIB.

authentication-server-down: Specifies notifications to be sent when the RADIUS authentication server becomes unreachable.

authentication-server-up: Specifies notifications to be sent when the RADIUS authentication server becomes reachable.

Usage guidelines

If you do not specify any keywords, this command enables or disables all types of notifications for RADIUS.

When SNMP notifications for RADIUS are enabled, the device supports the following notifications generated by RADIUS:

·     RADIUS server unreachable notification—The RADIUS server cannot be reached. RADIUS generates this notification if it cannot receive any response to an accounting or authentication request within the specified RADIUS request transmission attempts.

·     RADIUS server reachable notification—The RADIUS server can be reached. RADIUS generates this notification for a previously blocked RADIUS server after the quiet timer expires.

·     Excessive authentication failures notification—RADIUS generates this notification when the number of authentication failures to the total number of authentication attempts exceeds the specified threshold.

Examples

# Enable the device to send RADIUS accounting server unreachable notifications.

<Sysname> system-view

[Sysname] snmp-agent trap enable radius accounting-server-down

state primary

Use state primary to set the status of a primary RADIUS server.

Syntax

state primary { accounting | authentication } { active | block }

Default

A primary RADIUS server is in active state.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

accounting: Specifies the primary RADIUS accounting server.

authentication: Specifies the primary RADIUS authentication server.

active: Specifies the active state, the normal operation state.

block: Specifies the blocked state, the out-of-service state.

Usage guidelines

When the RADIUS server load sharing feature is disabled, the device first tries to communicate with the primary server if the primary server is in active state. If the primary server is unavailable, the device performs the following operations:

·     Changes the status of the primary server to blocked.

·     Starts a quiet timer for the server.

·     Tries to communicate with a secondary server in active state.

When the quiet timer of the primary server times out, the status of the server automatically changes to active. If you set the server status to blocked before the quiet timer times out, the server status cannot change back to active unless you manually set the status to active.

When the RADIUS server load sharing feature is enabled, the device checks the weight value and number of currently served users only for servers in active state. The most appropriate active server is selected for communication.

When the primary server and all secondary servers are in blocked state, the device tries to communicate with the primary server.

This command can affect the RADIUS server status detection feature when a valid test profile is specified for a primary RADIUS authentication server.

·     If you set the status of the server to blocked, the device stops detecting the status of the server.

·     If you set the status of the server to active, the device starts to detect the status of the server.

Examples

# In RADIUS scheme radius1, set the status of the primary authentication server to blocked.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] state primary authentication block

Related commands

display radius scheme

radius-server test-profile

server-load-sharing enable

state secondary

state secondary

Use state secondary to set the status of a secondary RADIUS server.

Syntax

state secondary { accounting | authentication } [ { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ] { active | block }

Default

A secondary RADIUS server is in active state.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

accounting: Specifies a secondary RADIUS accounting server.

authentication: Specifies a secondary RADIUS authentication server.

host-name: Specifies the host name of the secondary RADIUS server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies the IPv4 address of a secondary RADIUS server.

ipv6 ipv6-address: Specifies the IPv6 address of a secondary RADIUS server.

port-number: Specifies the service port number of a secondary RADIUS server. The value range for the UDP port number is 1 to 65535. The default port numbers for authentication and accounting are 1812 and 1813, respectively.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary RADIUS server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters.

active: Specifies the active state, the normal operation state.

block: Specifies the blocked state, the out-of-service state.

Usage guidelines

If you do not specify an IP address, this command changes the status of all configured secondary RADIUS servers.

If the device finds that a secondary server in active state is unreachable, the device performs the following operations:

·     Changes the status of the secondary server to blocked.

·     Starts a quiet timer for the server.

·     Tries to communicate with another secondary server in active state.

When the quiet timer of a server times out, the status of the server automatically changes to active. If you set the server status to blocked before the quiet timer times out, the server status cannot change back to active unless you manually set the status to active. If all configured secondary servers are unreachable, the device considers the authentication or accounting attempt a failure.

When the RADIUS server load sharing feature is enabled, the device checks the weight value and number of currently served users only for servers in active state. The most appropriate active server is selected for communication.

This command can affect the RADIUS server status detection feature when a valid test profile is specified for a secondary RADIUS authentication server.

·     If you set the status of the server to blocked, the device stops detecting the status of the server.

·     If you set the status of the server to active, the device starts to detect the status of the server.

Examples

# In RADIUS scheme radius1, set the status of all the secondary authentication servers to blocked.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] state secondary authentication block

Related commands

display radius scheme

radius-server test-profile

server-load-sharing enable

state primary

stop-accounting-buffer enable (RADIUS scheme view)

Use stop-accounting-buffer enable to enable buffering of RADIUS stop-accounting requests to which no responses have been received.

Use undo stop-accounting-buffer enable to disable the buffering feature.

Syntax

stop-accounting-buffer enable

undo stop-accounting-buffer enable

Default

The device buffers the RADIUS stop-accounting requests to which no responses have been received.

Views

RADIUS scheme view

Predefined user roles

network-admin

Usage guidelines

This command enables the device to buffer a RADIUS stop-accounting request that has no response after the maximum transmission attempts (set by using the retry command) have been made. The device resends the buffered request until it receives a server response or when the number of stop-accounting request transmission attempts reaches the upper limit. If no more attempts are available, the device discards the request. However, if you have removed an accounting server, stop-accounting requests destined for the server are not buffered.

Examples

# Enable buffering of RADIUS stop-accounting requests to which no responses have been received.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] stop-accounting-buffer enable

Related commands

display stop-accounting-buffer (for RADIUS)

reset stop-accounting-buffer (for RADIUS)

stop-accounting-packet send-force

Use stop-accounting-packet send-force to enable forcibly sending stop-accounting packets. The device will send stop-accounting packets when users for which no start-accounting packets are sent go offline.

Use undo stop-accounting-packet send-force to disable forcibly sending stop-accounting packets.

Syntax

stop-accounting-packet send-force

undo stop-accounting-packet send-force

Default

Forcibly sending stop-accounting packets is disabled. The device does not send stop-accounting packets when users for which no start-accounting packets are sent go offline.

Views

RADIUS scheme view

Predefined user roles

network-admin

Usage guidelines

Typically, if the device does not send a start-accounting packet to the RADIUS server for an authenticated user, it does not send a stop-accounting packet when the user goes offline. If the server has generated a user entry for the user without start-accounting packets, it does not release the user entry when the user goes offline. This feature forces the device to send stop-accounting packets to the RADIUS server when the user goes offline for timely releasing the user entry on the server.

Examples

# In RADIUS scheme radius1, enable forcibly sending stop-accounting packets.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] stop-accounting-packet send-force

Related commands

display radius scheme

test-aaa

Use test-aaa to perform an AAA test.

Syntax

test-aaa user user-name password password radius-scheme radius-scheme-name [ radius-server { ipv4-address | ipv6 ipv6-address } port-number [ vpn-instance vpn-instance-name ] ] [ chap | pap ] [ attribute-test-group attr-test-group-name ] [ trace ]

Views

User view

Predefined user roles

network-admin

Parameters

user user-name: Specifies the test username, a string of 1 to 80 characters. The username can be a pure username or contain a domain name. The format for a username containing a domain name is pure-username@domain-name. The pure username is case sensitive and the domain name is case insensitive.

password password: Specifies the password of the test user, a case-sensitive string of 1 to 63 characters.

radius-scheme radius-scheme-name: Specifies a RADIUS scheme by its name, a case-insensitive string of 1 to 32 characters.

radius-server: Specifies a RADIUS server.

ipv4-address: Specifies the IPv4 address of the RADIUS server.

ipv6 ipv6-address: Specifies the IPv6 address of the RADIUS server.

port-number: Specifies the UDP port number of the RADIUS server, in the range of 1 to 65535.

vpn-instance vpn-instance-name: Specifies the MPLS L3VPN instance to which the RADIUS server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

chap: Specifies the CHAP authentication method (the default).

pap: Specifies the PAP authentication method.

attribute-test-group attr-test-group-name: Specifies a RADIUS attribute test group by its name, a case-insensitive string of 1 to 31 characters. If you do not specify a RADIUS attribute test group or the specified RADIUS attribute test group does not exist, the device does not change the attributes carried in authentication or accounting requests.

trace: Displays detailed information about RADIUS packets exchanged during the AAA test. If you do not specify this keyword, the command displays brief information about the AAA test, including the sent and received packets and the test result.

Usage guidelines

Use this command to identify the reasons for the failure of interaction between the device and the AAA servers.

The device might communicate with the AAA servers incorrectly during an AAA test. Make sure no users come online or go offline during an AAA text.

If the configuration of the specified RADIUS scheme changes, the new configuration does not affect the current AAA test. The modification will take effect in the next test.

The system can have only one AAA test at a time. Another AAA test can be performed only after the current test finishes.

Examples

# Perform an AAA test and display detailed information about the test. The test uses username user1, password 123456, the CHAP authentication method, and RADIUS scheme test.

<Sysname> test-aaa user user1 password 123456 radius-scheme test chap trace

Sent a RADIUS authentication request.

  Server  IP   : 192.168.1.110

  Source  IP   : 192.168.1.166

  VPN instance : N/A

  Server port  : 1812

  Packet type  : Authentication request

  Packet length: 118 bytes

  Packet ID    : 0

  Attribute list:

    [User-Name(1)]                 [6]   [user1]

    [CHAP-Password(3)]             [19]  [******]

    [NAS-IP-Address(4)]            [6]   [192.168.1.166]

    [Service-Type(6)]              [6]   [2] [Framed]

    [Framed-Protocol(7)]           [6]   [1] [PPP]

    [NAS-Identifier(32)]           [5]   [Sysname]

    [Acct-Session-Id(44)]          [40]  [00000008201707241008280000000c16100171]

    [CHAP-Challenge(60)]           [18]  [******]

    [NAS-Port-Type(61)]            [6]   [15] [Ethernet]

 

Received a RADIUS authentication response.

  Server IP    : 192.168.1.110

  Source IP    : 192.168.1.166

  VPN instance : N/A

  Server port  : 1812

  Packet type  : Access-Reject

  Packet length: 20 bytes

  Packet ID    : 0

  Reply-Message: "E63032: Incorrect password. You can retry 9 times."

 

Sent a RADIUS start-accounting request.

  Server IP    : 192.168.1.110

  Source  IP   : 192.168.1.166

  VPN instance : N/A

  Server port  : 1813

  Packet type  : Start-accounting request

  Packet length: 63 bytes

  Packet ID    : 1

  Attribute list:

    [User-Name(1)]                  [6]   [user1]

    [Acct-Status-Type(40)]          [6]   [1] [Start]

    [NAS-IP-Address(4)]             [6]   [192.168.1.166]

    [NAS-Identifier(32)]            [5]   [Sysname]

    [Acct-Session-Id(44)]           [40]  [00000008201707241008280000000c16100171]

 

Received a RADIUS start-accounting response.

  Server  IP   : 192.168.1.110

  Source  IP   : 192.168.1.166

  VPN instance : N/A

  Server port  : 1813

  Packet type  : Start-accounting response

  Packet length: 20 bytes

  Packet ID    : 1

 

Sent a RADIUS stop-accounting request.

  Server  IP   : 192.168.1.110

  Source  IP   : 192.168.1.166

  VPN instance : N/A

  Server port  : 1813

  Packet type  : Stop-accounting request

  Packet length: 91 bytes

  Packet ID    : 1

  Attribute list:

    [User-Name(1)]                  [6]   [user1]

    [Acct-Status-Type(40)]          [6]   [2] [Stop]

    [NAS-IP-Address(4)]             [6]   [192.168.1.166]

    [NAS-Identifier(32)]            [5]   [Sysname]

    [Acct-Delay-Time(41)]           [6]   [0]

    [Acct-Session-Id(44)]           [40]  [00000008201707241008280000000c16100171]

    [Acct-Terminate-Cause(49)]      [6]   [1] [User Request]

 

Received a RADIUS stop-accounting response.

  Server  IP   : 192.168.1.110

  Source  IP   : 192.168.1.166

  VPN instance : N/A

  Server port  : 1813

  Packet type  : Stop-accounting response

  Packet length: 20 bytes

  Packet ID    : 1

 

Test result: Failed

# Perform an AAA test and display brief information about the test. The test uses username user1, password 123456 and the CHAP authentication method to test RADIUS server at 192.168.1.110 in RADIUS scheme test.

<Sysname> test-aaa user user1 password 123456 radius-scheme test radius-server 192.168.1.110 1812

Sent a RADIUS authentication request.

Received a RADIUS authentication response.

 

Test result: Successful

Table 11 Command output

Field

Description

Server IP

IP address of the server.

Source IP

Source IP address of the RADIUS packet.

VPN instance

MPLS L3VPN instance to which the server belongs. This field displays N/A if the server belongs to the public network.

Server port

UDP port number of the server.

Packet type

Type of the RADIUS packet:

·     Authentication request.

·     Access-Accept.

·     Access-Reject.

·     Start-accounting request.

·     Start-accounting response.

·     Stop-accounting request.

·     Stop-accounting response.

Packet length

Total length of the RADIUS packet, in bytes.

Packet ID

ID of the RADIUS packet. This field is used to identity a pair of request and response packets.

[attribute-name (code)]  [length]  [value] [description]

Information about a RADIUS attribute:

·     attribute-name—Name of the attribute.

·     code—Code of the attribute.

·     length—Length of the attribute, in bytes.

·     value—Value of the attribute.

·     description—Description of the attribute.

Reply-Message:

The RADIUS server rejected the authentication request and replied a message.

Test result

Result of the AAA test:

·     Successful—The test has succeeded.

·     Failed—The test has failed. If any request is rejected, the test fails.

 

Related commands

radius scheme

radius attribute-test-group

timer quiet (RADIUS scheme view)

Use timer quiet to set the quiet timer for the servers specified in a RADIUS scheme.

Use undo timer quiet to restore the default.

Syntax

timer quiet minutes

undo timer quiet

Default

The server quiet timer period is 5 minutes in a RADIUS scheme.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

minutes: Specifies the server quiet period in minutes, in the range of 0 to 255. If you set this argument to 0, the device does not change the state of the current server for a user when the server is unreachable. It sends an authentication or accounting request of the user to the next server in active state. For an authentication or accounting request of a new user, it still tries to send the request to the current server because the current server is in active state.

Usage guidelines

Make sure the server quiet timer is set correctly.

A timer that is too short might result in frequent authentication or accounting failures. This is because the device will continue to attempt to communicate with an unreachable server that is in active state.

A timer that is too long might temporarily block a reachable server that has recovered from a failure. This is because the server will remain in blocked state until the timer expires.

Examples

# In RADIUS scheme radius1, set the quiet timer to 10 minutes for the servers.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] timer quiet 10

Related commands

display radius scheme

timer realtime-accounting (RADIUS scheme view)

Use timer realtime-accounting to set the real-time accounting interval.

Use undo timer realtime-accounting to restore the default.

Syntax

timer realtime-accounting interval [ second ]

undo timer realtime-accounting

Default

The real-time accounting interval is 12 minutes.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

interval: Specifies the real-time accounting interval in the range of 0 to 71582.

second: Specifies the measurement unit as second. If you do not specify this keyword, the real-time accounting interval is measured in minutes.

Usage guidelines

When the real-time accounting interval on the device is not zero, the device sends online user accounting information to the RADIUS accounting server at the configured interval.

When the real-time accounting interval on the device is zero, the device sends online user accounting information to the RADIUS accounting server at the real-time accounting interval configured on the server. If the real-time accounting interval is not configured on the server, the device does not send online user accounting information.

A short interval helps improve accounting precision but requires many system resources.

Table 12 Recommended real-time accounting intervals

Number of users

Real-time accounting interval

1 to 99

3 minutes

100 to 499

6 minutes

500 to 999

12 minutes

1000 or more

15 minutes or longer

 

When you modify the real-time accounting interval, the following rules apply to users that have been online before the modification:

·     If you modify the real-time accounting interval from a non-zero value to zero or from zero to a non-zero value, the modification does not take effect on these users. These users still use the old real-time accounting interval.

·     If you modify the real-time accounting interval from a non-zero value to another non-zero value, the modification takes effect immediately on these users.

If a user uses RADIUS accounting but not RADIUS authentication and authorization, the device performs real-time accounting for that user only based on the real-time accounting interval set in the user's RADIUS accounting scheme. The real-time accounting interval assigned by the RADIUS accounting server does not take effect.

Examples

# In RADIUS scheme radius1, set the real-time accounting interval to 51 minutes.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] timer realtime-accounting 51

Related commands

retry realtime-accounting

timer response-timeout (RADIUS scheme view)

Use timer response-timeout to set the RADIUS server response timeout timer.

Use undo timer response-timeout to restore the default.

Syntax

timer response-timeout seconds

undo timer response-timeout

Default

The RADIUS server response timeout period is 3 seconds.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

seconds: Specifies the RADIUS server response timeout period, in the range of 1 to 10 seconds.

Usage guidelines

If a NAS receives no response from the RADIUS server in a period of time after sending a RADIUS request, it resends the request so that the user has more opportunity to obtain the RADIUS service. The NAS uses the RADIUS server response timeout timer to control the transmission interval.

If the client times out during the authentication process, the user is immediately logged off. To avoid user logoffs, the value multiplied by the following items cannot be larger than the client timeout period defined by the access module:

·     The maximum number of RADIUS packet transmission attempts.

·     The RADIUS server response timeout period.

·     The number of RADIUS servers in the RADIUS scheme.

When the device sends a RADIUS request to a new RADIUS server, it checks the total amount of time it has taken to transmit the RADIUS packet. If the amount of time has reached 300 seconds, the device stops sending the RADIUS request to the next RADIUS server. As a best practice, consider the number of RADIUS servers when you configure the maximum number of packet transmission attempts and the RADIUS server response timeout period.

Examples

# In RADIUS scheme radius1, set the RADIUS server response timeout timer to 5 seconds.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] timer response-timeout 5

Related commands

display radius scheme

retry

user-name-format (RADIUS scheme view)

Use user-name-format to specify the format of the username to be sent to a RADIUS server.

Use undo user-name-format to restore the default.

Syntax

user-name-format { keep-original | with-domain | without-domain }

undo user-name-format

Default

The ISP domain name is included in the usernames sent to a RADIUS server.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

keep-original: Sends the username to the RADIUS server as the username is entered.

with-domain: Includes the ISP domain name in the username sent to the RADIUS server.

without-domain: Excludes the ISP domain name from the username sent to the RADIUS server.

Usage guidelines

A username is generally in the userid@isp-name format, of which the isp-name argument is used by the device to determine the ISP domain to which a user belongs. Some earlier RADIUS servers, however, cannot recognize a username containing an ISP domain name. Before sending a username including a domain name to such a RADIUS server, the device must remove the domain name. This command allows you to specify whether to include a domain name in a username sent to a RADIUS server.

If a RADIUS scheme defines that the username is sent without the ISP domain name, do not apply the scheme to more than one ISP domain. Otherwise, the RADIUS server will consider two users in different ISP domains but with the same userid as one user.

For 802.1X users using EAP authentication, the user-name-format command configured for a RADIUS scheme does not take effect. The device does not change the usernames from clients before forwarding them to the RADIUS server.

Examples

# In RADIUS scheme radius1, configure the device to remove the domain name from the usernames sent to the RADIUS servers.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] user-name-format without-domain

Related commands

display radius scheme

vpn-instance (RADIUS scheme view)

Use vpn-instance to specify an MPLS L3VPN instance for a RADIUS scheme.

Use undo vpn-instance to restore the default.

Syntax

vpn-instance vpn-instance-name

undo vpn-instance

Default

The RADIUS scheme belongs to the public network.

Views

RADIUS scheme view

Predefined user roles

network-admin

Parameters

vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters.

Usage guidelines

The VPN instance specified for a RADIUS scheme applies to all authentication and accounting servers in that scheme. If a VPN instance is also configured for an individual RADIUS server, the VPN instance specified for the RADIUS scheme does not take effect on that server.

Examples

# Specify VPN instance test for RADIUS scheme radius1.

<Sysname> system-view

[Sysname] radius scheme radius1

[Sysname-radius-radius1] vpn-instance test

Related commands

display radius scheme

HWTACACS commands

data-flow-format (HWTACACS scheme view)

Use data-flow-format to set the data flow and packet measurement units for traffic statistics.

Use undo data-flow-format to restore the default.

Syntax

data-flow-format { data { byte | giga-byte | kilo-byte | mega-byte } | packet { giga-packet | kilo-packet | mega-packet | one-packet } } *

undo data-flow-format { data | packet }

Default

Traffic is counted in bytes and packets.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

data: Specifies the unit for data flows.

byte: Specifies the unit as byte.

giga-byte: Specifies the unit as gigabyte.

kilo-byte: Specifies the unit as kilobyte.

mega-byte: Specifies the unit as megabyte.

packet: Specifies the unit for data packets.

giga-packet: Specifies the unit as giga-packet.

kilo-packet: Specifies the unit as kilo-packet.

mega-packet: Specifies the unit as mega-packet.

one-packet: Specifies the unit as one-packet.

Usage guidelines

The data flow and packet measurement units for traffic statistics must be the same as configured on the HWTACACS accounting servers. Otherwise, accounting results might be incorrect.

Examples

# In HWTACACS scheme hwt1, set the data flow and packet measurement units for traffic statistics to kilobyte and kilo-packet, respectively.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] data-flow-format data kilo-byte packet kilo-packet

Related commands

display hwtacacs scheme

display hwtacacs scheme

Use display hwtacacs scheme to display the configuration or statistics of HWTACACS schemes.

Syntax

display hwtacacs scheme [ hwtacacs-scheme-name [ statistics ] ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters. If you do not specify an HWTACACS scheme, this command displays the configuration of all HWTACACS schemes.

statistics: Displays the HWTACACS service statistics. If you do not specify this keyword, the command displays the configuration of the specified HWTACACS scheme.

Examples

# Displays the configuration of all HWTACACS schemes.

<Sysname> display hwtacacs scheme

Total 1 HWTACACS schemes

 

------------------------------------------------------------------

HWTACACS Scheme Name  : hwtac

  Index : 0

  Primary Auth Server:

    Host name: Not configured

    IP  : 2.2.2.2         Port: 49     State: Active

    VPN Instance: 2

    Single-connection: Enabled

  Primary Author Server:

    Host name: Not configured

    IP  : 2.2.2.2         Port: 49     State: Active

    VPN Instance: 2

    Single-connection: Disabled

  Primary Acct Server:

    Host name: Not configured

    IP  : Not Configured  Port: 49     State: Block

    VPN Instance: Not configured

    Single-connection: Disabled

 

  VPN Instance                          : 2

  NAS IP Address                        : 2.2.2.3

  Server Quiet Period(minutes)          : 5

  Realtime Accounting Interval(minutes) : 12

  Stop-accounting packets buffering     : Enabled

    Retransmission times                : 100

  Response Timeout Interval(seconds)    : 5

  Username Format                       : with-domain

  Data flow unit                        : Byte

  Packet unit                           : one

------------------------------------------------------------------

Table 13 Command output

Field

Description

Index

Index number of the HWTACACS scheme.

Primary Auth Server

Primary HWTACACS authentication server.

Primary Author Server

Primary HWTACACS authorization server.

Primary Acct Server

Primary HWTACACS accounting server.

Secondary Auth Server

Secondary HWTACACS authentication server.

Secondary Author Server

Secondary HWTACACS authorization server.

Secondary Acct Server

Secondary HWTACACS accounting server.

Host name

Host name of the server.

This field displays Not configured in the following situations:

·     The server is not configured.

·     The server is specified by IP address.

IP

IP address of the server.

This field displays Not configured in the following situations:

·     The server is not configured.

·     The server is specified by hostname, and the hostname is not resolved.

Port

Service port of the HWTACACS server. If no port configuration is performed, this field displays the default port number.

State

Status of the HWTACACS server: active or blocked.

VPN Instance

MPLS L3VPN instance to which the HWTACACS server or scheme belongs. If no VPN instance is specified for the server or scheme, this field displays Not configured.

Single-connection

Single connection status:

·     Enabled—Establish only one TCP connection for all users to communicate with the server.

·     Disabled—Establish a TCP connection for each user to communicate with the server.

NAS IP Address

Source interface or source IP addresses for outgoing HWTACACS packets.

This field displays Not configured if no source interface or source IP addresses are specified for outgoing HWTACACS packets.

Server Quiet Period(minutes)

Quiet period for the primary servers, in minutes.

Realtime Accounting Interval(minutes)

Real-time accounting interval, in minutes.

Stop-accounting packets buffering

Whether buffering of nonresponded HWTACACS stop-accounting requests is enabled.

Retransmission times

Maximum number of transmission attempts for individual HWTACACS stop-accounting requests.

Response Timeout Interval(seconds)

HWTACACS server response timeout period, in seconds.

Username Format

Format for the usernames sent to the HWTACACS server:

·     with-domain—Includes the domain name.

·     without-domain—Excludes the domain name.

·     keep-original—Forwards the username as the username is entered.

Data flow unit

Measurement unit for data flows.

Packet unit

Measurement unit for packets.

 

# Display statistics for HWTACACS scheme tac.

<Sysname> display hwtacacs scheme tac statistics

 

Primary authentication server : 111.8.0.244

    Round trip time:                                20 seconds

    Request packets:                                1

    Login request packets:                          1

    Change-password request packets:                0

    Request packets including plaintext passwords:  0

    Request packets including ciphertext passwords: 0

    Response packets:                               2

    Pass response packets:                          1

    Failure response packets:                       0

    Get-data response packets:                      0

    Get-username response packets:                  0

    Get-password response packets:                  1

    Restart response packets:                       0

    Error response packets:                         0

    Follow response packets:                        0

    Malformed response packets:                     0

    Continue packets:                               1

    Continue-abort packets:                         0

    Pending request packets:                        0

    Timeout packets:                                0

    Unknown type response packets:                  0

    Dropped response packets:                       0

 

Primary authorization server :111.8.0.244

    Round trip time:                               1 seconds

    Request packets:                               1

    Response packets:                              1

    PassAdd response packets:                      1

    PassReply response packets:                    0

    Failure response packets:                      0

    Error response packets:                        0

    Follow response packets:                       0

    Malformed response packets:                    0

    Pending request packets:                       0

    Timeout packets:                               0

    Unknown type response packets:                 0

    Dropped response packets:                      0

 

Primary accounting server :111.8.0.244

    Round trip time:                               0 seconds

    Request packets:                               2

    Accounting start request packets:              1

    Accounting stop request packets:               1

    Accounting update request packets:             0

    Pending request packets:                       0

    Response packets:                              2

    Success response packets:                      2

    Error response packets:                        0

    Follow response packets:                       0

    Malformed response packets:                    0

    Timeout response packets:                      0

    Unknown type response packets:                 0

    Dropped response packets:                      0

Table 14 Command output

Field

Description

Primary authentication server

Primary HWTACACS authentication server.

Primary authorization server

Primary HWTACACS authorization server.

Primary accounting server

Primary HWTACACS accounting server.

Secondary authentication server

Secondary HWTACACS authentication server.

Secondary authorization server

Secondary HWTACACS authorization server.

Secondary accounting server

Secondary HWTACACS accounting server.

Round trip time

The time interval during which the device processed a pair of request and response. The unit is second.

Request packets

Total number of sent request packets.

Login request packets

Number of sent login request packets.

Change-password request packets

Number of sent request packets for changing passwords.

Request packets including plaintext passwords

Number of request packets that include plaintext passwords.

Request packets including ciphertext passwords

Number of request packets that include ciphertext passwords.

Response packets

Total number of received response packets.

Pass response packets

Number of response packets indicating successful authentication.

Failure response packets

Number of response packets indicating authentication or authorization failure.

Get-data response packets

Number of response packets for obtaining user data.

Get-username response packets

Number of response packets for obtaining usernames.

Get-password response packets

Number of response packets for obtaining passwords.

Restart response packets

Number of response packets for reauthentication.

Error response packets

Number of error-type response packets.

Follow response packets

Number of follow-type response packets.

Malformed response packets

Number of malformed response packets.

Continue packets

Number of sent Continue packets.

Continue-abort packets

Number of sent Continue-abort packets.

Pending request packets

Number of request packets waiting for a response.

Timeout packets/Timeout response packets

Number of timeout response packets.

Unknown type response packets

Number of unknown-type response packets.

Dropped response packets

Number of dropped response packets.

PassAdd response packets

Number of received PassAdd response packets. The packets indicate that all requested authorization attributes are assigned and additional authorization attributes are added.

PassReply response packets

Number of received PassReply response packets. The device uses the specified authorization attributes in the packets to replace the requested authorization attributes.

Accounting start request packets

Number of accounting start request packets.

Accounting stop request packets

Number of accounting stop request packets.

Accounting update request packets

Number of accounting update request packets.

Success response packets

Number of accounting success response packets.

 

Related commands

reset hwtacacs statistics

display stop-accounting-buffer (for HWTACACS)

Use display stop-accounting-buffer to display information about buffered HWTACACS stop-accounting requests to which no responses have been received.

Syntax

display stop-accounting-buffer hwtacacs-scheme hwtacacs-scheme-name

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

Examples

# Display information about nonresponded stop-accounting requests buffered for HWTACACS scheme hwt1.

<Sysname> display stop-accounting-buffer hwtacacs-scheme hwt1

Total entries: 2

Scheme    IP address        Username      First sending time     Attempts

hwt1      192.168.100.1     abc           23:27:16-08/31/2015    19

hwt1      192.168.90.6      bob           23:33:01-08/31/2015    20

Table 15 Command output

Field

Description

First sending time

Time when the stop-accounting request was first sent.

Attempts

Number of attempts that were made to send the stop-accounting request.

 

Related commands

reset stop-accounting-buffer (for HWTACACS)

retry stop-accounting (HWTACACS scheme view)

stop-accounting-buffer enable (HWTACACS scheme view)

user-name-format (HWTACACS scheme view)

hwtacacs nas-ip

Use hwtacacs nas-ip to specify a source interface or source IP address for outgoing HWTACACS packets.

Use undo hwtacacs nas-ip to delete the specified source interface or source IP address for outgoing HWTACACS packets.

Syntax

hwtacacs nas-ip { interface interface-type interface-number | { ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] }

undo hwtacacs nas-ip { interface | { ipv4-address | ipv6 ipv6-address } [ vpn-instance vpn-instance-name ] }

Default

The source IP address of an HWTACACS packet sent to the server is the primary IPv4 address or the IPv6 address of the outbound interface.

Views

System view

Predefined user roles

network-admin

Parameters

interface interface-type interface-number: Specifies a source interface by its type and number. The device uses the primary IPv4 address or the IPv6 address of the interface as the source IP address of an outgoing HWTACACS packet.

ipv4-address: Specifies an IPv4 address, which must be an address of the device. The IP address cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address.

ipv6 ipv6-address: Specifies an IPv6 address, which must be a unicast address of the device and cannot be a loopback address or a link-local address.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the source IP address belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. To configure a public-network source IP address, do not specify this option.

Usage guidelines

The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS that is configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon receiving an HWTACACS packet, the HWTACACS server checks the source IP address of the packet.

·     If the source IP address of the packet is the IP address of a managed NAS, the server processes the packet.

·     If the source IP address of the packet is not the IP address of a managed NAS, the server drops the packet.

As a best practice, specify a loopback interface address as the source IP address for outgoing HWTACACS packets to avoid HWTACACS packet loss caused by physical port errors.

If you use both the nas-ip command and hwtacacs nas-ip command, the following guidelines apply:

·     The setting configured by using the nas-ip command in HWTACACS scheme view applies only to the HWTACACS scheme.

·     The setting configured by using the hwtacacs nas-ip command in system view applies to all HWTACACS schemes.

·     The setting in HWTACACS scheme view takes precedence over the setting in system view.

You can specify a maximum of 16 source IP addresses in system view, including:

·     Zero or one public-network source IPv4 address.

·     Zero or one public-network source IPv6 address.

·     Private-network source IP addresses.

Each VPN instance can have only one private-network source IPv4 address and one private-network source IPv6 address in system view.

You can specify only one source interface to provide the source IP address for outgoing HWTACACS packets. Make sure the route between the source interface and the HWTACACS server is reachable.

The source interface configuration and the source IP address configuration overwrite each other.

Examples

# Specify IP address 129.10.10.1 as the source IP address for HWTACACS packets.

<Sysname> system-view

[Sysname] hwtacacs nas-ip 129.10.10.1

Related commands

nas-ip (HWTACACS scheme view)

hwtacacs scheme

Use hwtacacs scheme to create an HWTACACS scheme and enter its view, or enter the view of an existing HWTACACS scheme.

Use undo hwtacacs scheme to delete an HWTACACS scheme.

Syntax

hwtacacs scheme hwtacacs-scheme-name

undo hwtacacs scheme hwtacacs-scheme-name

Default

No HWTACACS schemes exist.

Views

System view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme-name: Specifies the HWTACACS scheme name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

An HWTACACS scheme can be used by more than one ISP domain at the same time.

You can configure a maximum of 16 HWTACACS schemes.

Examples

# Create an HWTACACS scheme named hwt1 and enter HWTACACS scheme view.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1]

Related commands

display hwtacacs scheme

key (HWTACACS scheme view)

Use key to set the shared key for secure HWTACACS authentication, authorization, or accounting communication.

Use undo key to delete the shared key for secure HWTACACS authentication, authorization, or accounting communication.

Syntax

key { accounting | authentication | authorization } { cipher | simple } string

undo key { accounting | authentication | authorization }

Default

No shared key is configured for secure HWTACACS authentication, authorization, or accounting communication.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

accounting: Specifies the shared key for secure HWTACACS accounting communication.

authentication: Specifies the shared key for secure HWTACACS authentication communication.

authorization: Specifies the shared key for secure HWTACACS authorization communication.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the key is a string of 1 to 255 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 373 characters. The plaintext form of the key is a string of 15 to 255 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

Usage guidelines

The shared keys configured on the device must match those configured on the HWTACACS servers.

Examples

# In HWTACACS scheme hwt1, set the shared key to 123456TESTauth&! in plaintext form for secure HWTACACS authentication communication.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] key authentication simple 123456TESTauth&!

# Set the shared key to 123456TESTautr&! in plaintext form for secure HWTACACS authorization communication.

[Sysname-hwtacacs-hwt1] key authorization simple 123456TESTautr&!

# Set the shared key to 123456TESTacct&! in plaintext form for secure HWTACACS accounting communication.

[Sysname-hwtacacs-hwt1] key accounting simple 123456TESTacct&!

Related commands

display hwtacacs scheme

nas-ip (HWTACACS scheme view)

Use nas-ip to specify a source interface or source IP address for outgoing HWTACACS packets.

Use undo nas-ip to delete the specified source interface or source IP address for outgoing HWTACACS packets.

Syntax

nas-ip { ipv4-address | interface interface-type interface-number | ipv6 ipv6-address }

undo nas-ip [ interface | ipv6 ]

Default

The source IP address of an outgoing HWTACACS packet is that configured by using the hwtacacs nas-ip command in system view.

If the hwtacacs nas-ip command is not used, the source IP address is the primary IP address of the outbound interface.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

interface interface-type interface-number: Specifies a source interface by its type and number. The device uses the primary IPv4 address or the IPv6 address of the interface as the source IP address of an outgoing HWTACACS packet.

ipv4-address: Specifies an IPv4 address, which must be an address of the device. The IP address cannot be 0.0.0.0, 255.255.255.255, a class D address, a class E address, or a loopback address.

ipv6 ipv6-address: Specifies an IPv6 address, which must be a unicast address of the device and cannot be a loopback address or a link-local address.

Usage guidelines

The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS that is configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon receiving an HWTACACS packet, the HWTACACS server checks the source IP address of the packet.

·     If the source IP address of the packet is the IP address of a managed NAS, the server processes the packet.

·     If the source IP address of the packet is not the IP address of a managed NAS, the server drops the packet.

As a best practice, specify a loopback interface address as the source IP address for outgoing HWTACACS packets to avoid HWTACACS packet loss caused by physical port errors.

If you use both the nas-ip command and hwtacacs nas-ip command, the following guidelines apply:

·     The setting configured by using the nas-ip command in HWTACACS scheme view applies only to the HWTACACS scheme.

·     The setting configured by using the hwtacacs nas-ip command in system view applies to all HWTACACS schemes.

·     The setting in HWTACACS scheme view takes precedence over the setting in system view.

For an HWTACACS scheme, the following restrictions apply:

·     You can specify only one source IPv4 address and one source IPv6 address for outgoing HWTACACS packets.

·     You can specify only one source interface to provide the source IP address for outgoing HWTACACS packets. Make sure the route between the source interface and the HWTACACS server is reachable.

·     The source interface configuration and the source IP address configuration overwrite each other.

If you do not specify any parameter for the undo nas-ip command, the command deletes the configured source IPv4 address for outgoing HWTACACS packets.

Examples

# In HWTACACS scheme hwt1, specify IP address 10.1.1.1 as the source address for outgoing HWTACACS packets.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] nas-ip 10.1.1.1

Related commands

display hwtacacs scheme

hwtacacs nas-ip

primary accounting (HWTACACS scheme view)

Use primary accounting to specify the primary HWTACACS accounting server.

Use undo primary accounting to restore the default.

Syntax

primary accounting { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *

undo primary accounting

Default

The primary HWTACACS accounting server is not specified.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

host-name: Specifies the host name of the primary HWTACACS accounting server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies an IPv4 address of the primary HWTACACS accounting server.

ipv6 ipv6-address: Specifies an IPv6 address of the primary HWTACACS accounting server.

port-number: Specifies the service port number of the primary HWTACACS accounting server. The value range for the TCP port number is 1 to 65535. The default setting is 49.

key: Specifies the shared key for secure communication with the primary HWTACACS accounting server.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the key is a string of 1 to 255 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 373 characters. The plaintext form of the key is a string of 15 to 255 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

single-connection: The device and the primary HWTACACS accounting server use the same TCP connection to exchange accounting packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges accounting packets with the primary accounting server for a user.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the primary HWTACACS accounting server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

Usage guidelines

Make sure the port number and shared key settings of the primary HWTACACS accounting server are the same as those configured on the server.

Two accounting servers specified for a scheme, primary or secondary, cannot have identical VPN instance, host name, IP address, and port number settings.

As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.

If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.

You can remove an accounting server only when it is not used for user accounting. Removing an accounting server affects only accounting processes that occur after the remove operation.

Examples

# In HWTACACS scheme hwt1, specify the primary accounting server with IP address 10.163.155.12, TCP port number 49, and plaintext shared key 123456TESTacct&!.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] primary accounting 10.163.155.12 49 key simple 123456TESTacct&!

Related commands

display hwtacacs scheme

key (HWTACACS scheme view)

secondary accounting (HWTACACS scheme view)

vpn-instance (HWTACACS scheme view)

primary authentication (HWTACACS scheme view)

Use primary authentication to specify the primary HWTACACS authentication server.

Use undo primary authentication to restore the default.

Syntax

primary authentication { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *

undo primary authentication

Default

The primary HWTACACS authentication server is not specified.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

host-name: Specifies the host name of the primary HWTACACS authentication server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies the IPv4 address of the primary HWTACACS authentication server.

ipv6 ipv6-address: Specifies the IPv6 address of the primary HWTACACS authentication server.

port-number: Specifies the service port number of the primary HWTACACS authentication server. The value range for the TCP port number is 1 to 65535. The default setting is 49.

key: Specifies the shared key for secure communication with the primary HWTACACS authentication server.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the key is a string of 1 to 255 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 373 characters. The plaintext form of the key is a string of 15 to 255 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

single-connection: The device and the primary HWTACACS authentication server use the same TCP connection to exchange all authentication packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges authentication packets with the primary authentication server for a user.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the primary HWTACACS authentication server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

Usage guidelines

Make sure the port number and shared key settings of the primary HWTACACS authentication server are the same as those configured on the server.

Two authentication servers specified for a scheme, primary or secondary, cannot have identical VPN instance, host name, IP address, and port number settings.

As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.

If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.

You can remove an authentication server only when it is not used for user authentication. Removing an authentication server affects only authentication processes that occur after the remove operation.

Examples

# In HWTACACS scheme hwt1, specify the primary authentication server with IP address 10.163.155.13, TCP port number 49, and plaintext shared key 123456TESTauth&!.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] primary authentication 10.163.155.13 49 key simple 123456TESTauth&!

Related commands

display hwtacacs scheme

key (HWTACACS scheme view)

secondary authentication (HWTACACS scheme view)

vpn-instance (HWTACACS scheme view)

primary authorization

Use primary authorization to specify the primary HWTACACS authorization server.

Use undo primary authorization to restore the default.

Syntax

primary authorization { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *

undo primary authorization

Default

The primary HWTACACS authorization server is not specified.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

host-name: Specifies the host name of the primary HWTACACS authorization server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies the IPv4 address of the primary HWTACACS authorization server.

ipv6 ipv6-address: Specifies the IPv6 address of the primary HWTACACS authorization server.

port-number: Specifies the service port number of the primary HWTACACS authorization server. The value range for the TCP port number is 1 to 65535. The default setting is 49.

key: Specifies the shared key for secure communication with the primary HWTACACS authorization server.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the key is a string of 1 to 255 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 373 characters. The plaintext form of the key is a string of 15 to 255 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

single-connection: The device and the primary HWTACACS authorization server use the same TCP connection to exchange all authorization packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges authorization packets with the primary authorization server for a user.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the primary HWTACACS authorization server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

Usage guidelines

Make sure the port number and shared key settings of the primary HWTACACS authorization server are the same as those configured on the server.

Two authorization servers specified for a scheme, primary or secondary, cannot have identical VPN instance, host name, IP address, and port number settings.

As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.

If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.

You can remove an authorization server only when it is not used for user authorization. Removing an authorization server affects only authorization processes that occur after the remove operation.

Examples

# In HWTACACS scheme hwt1, specify the primary authorization server with IP address 10.163.155.13, TCP port number 49, and plaintext shared key 123456TESTautr&!.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] primary authorization 10.163.155.13 49 key simple 123456TESTautr&!

Related commands

display hwtacacs scheme

key (HWTACACS scheme view)

secondary authorization (HWTACACS scheme view)

vpn-instance (HWTACACS scheme view)

reset hwtacacs statistics

Use reset hwtacacs statistics to clear HWTACACS statistics.

Syntax

reset hwtacacs statistics { accounting | all | authentication | authorization }

Views

User view

Predefined user roles

network-admin

Parameters

accounting: Clears the HWTACACS accounting statistics.

all: Clears all HWTACACS statistics.

authentication: Clears the HWTACACS authentication statistics.

authorization: Clears the HWTACACS authorization statistics.

Examples

# Clear all HWTACACS statistics.

<Sysname> reset hwtacacs statistics all

Related commands

display hwtacacs scheme

reset stop-accounting-buffer (for HWTACACS)

Use reset stop-accounting-buffer to clear buffered HWTACACS stop-accounting requests to which no responses have been received.

Syntax

reset stop-accounting-buffer hwtacacs-scheme hwtacacs-scheme-name

Views

User view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

Examples

# Clear nonresponded stop-accounting requests buffered for HWTACACS scheme hwt1.

<Sysname> reset stop-accounting-buffer hwtacacs-scheme hwt1

Related commands

display stop-accounting-buffer (for HWTACACS)

stop-accounting-buffer enable (HWTACACS scheme view)

retry stop-accounting (HWTACACS scheme view)

Use retry stop-accounting to set the maximum number of transmission attempts for individual HWTACACS stop-accounting requests.

Use undo retry stop-accounting to restore the default.

Syntax

retry stop-accounting retries

undo retry stop-accounting

Default

The maximum number of transmission attempts for individual HWTACACS stop-accounting requests is 100.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

retries: Specifies the maximum number of transmission attempts for HWTACACS stop-accounting requests. The value range is 1 to 300.

Examples

# In HWTACACS scheme hwt1, set the maximum number of HWTACACS stop-accounting attempts to 300.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] retry stop-accounting 300

Related commands

display stop-accounting-buffer (for HWTACACS)

timer response-timeout (HWTACACS scheme view)

secondary accounting (HWTACACS scheme view)

Use secondary accounting to specify a secondary HWTACACS accounting server.

Use undo secondary accounting to remove a secondary HWTACACS accounting server.

Syntax

secondary accounting { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *

undo secondary accounting [ { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ]

Default

No secondary HWTACACS accounting servers are specified.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

host-name: Specifies the host name of a secondary HWTACACS accounting server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies the IPv4 address of a secondary HWTACACS accounting server.

ipv6 ipv6-address: Specifies the IPv6 address of a secondary HWTACACS accounting server.

port-number: Specifies the service port number of the secondary HWTACACS accounting server. The value range for the TCP port number is 1 to 65535. The default setting is 49.

key: Specifies the shared key for secure communication with the secondary HWTACACS accounting server.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the key is a string of 1 to 255 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 373 characters. The plaintext form of the key is a string of 15 to 255 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

single-connection: The device and the secondary HWTACACS accounting server use the same TCP connection to exchange all accounting packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges accounting packets with the secondary accounting server for a user.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary HWTACACS accounting server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

Usage guidelines

Make sure the port number and shared key settings of the secondary HWTACACS accounting server are the same as those configured on the server.

An HWTACACS scheme supports a maximum of 16 secondary HWTACACS accounting servers. If the primary server fails, the device tries to communicate with a secondary server in active state. The device connects to the secondary servers in the order they are configured.

If you do not specify any parameters for the undo secondary accounting command, the command removes all secondary accounting servers.

Two accounting servers specified for a scheme, primary or secondary, cannot have identical VPN instance, host name, IP address, and port number settings.

As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.

If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.

You can remove an accounting server only when it is not used for user accounting. Removing an accounting server affects only accounting processes that occur after the remove operation.

Examples

# In HWTACACS scheme hwt1, specify a secondary accounting server with IP address 10.163.155.12, TCP port number 49, and plaintext shared key 123456TESTacct&!.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] secondary accounting 10.163.155.12 49 key simple 123456TESTacct&!

Related commands

display hwtacacs scheme

key (HWTACACS scheme view)

primary accounting (HWTACACS scheme view)

vpn-instance (HWTACACS scheme view)

secondary authentication (HWTACACS scheme view)

Use secondary authentication to specify a secondary HWTACACS authentication server.

Use undo secondary authentication to remove a secondary HWTACACS authentication server.

Syntax

secondary authentication { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *

undo secondary authentication [ { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ]

Default

No secondary HWTACACS authentication servers are specified.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

host-name: Specifies the host name of a secondary HWTACACS authentication server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies the IPv4 address of a secondary HWTACACS authentication server.

ipv6 ipv6-address: Specifies the IPv6 address of a secondary HWTACACS authentication server.

port-number: Specifies the service port number of the secondary HWTACACS authentication server. The value range for the TCP port number is 1 to 65535. The default setting is 49.

key: Specifies the shared key for secure communication with the secondary HWTACACS authentication server.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the key is a string of 1 to 255 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 373 characters. The plaintext form of the key is a string of 15 to 255 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

single-connection: The device and the secondary HWTACACS authentication server use the same TCP connection to exchange all authentication packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges authentication packets with the secondary authentication server for a user.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary HWTACACS authentication server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

Usage guidelines

Make sure the port number and shared key settings of each secondary HWTACACS authentication server are the same as those configured on the corresponding server.

An HWTACACS scheme supports a maximum of 16 secondary HWTACACS authentication servers. If the primary server fails, the device tries to communicate with a secondary server in active state. The device connects to the secondary servers in the order they are configured.

If you do not specify any parameters for the undo secondary authentication command, the command removes all secondary authentication servers.

Two authentication servers specified for a scheme, primary or secondary, cannot have identical VPN instance, host name, IP address, and port number settings.

As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.

If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.

You can remove an authentication server only when it is not used for user authentication. Removing an authentication server affects only authentication processes that occur after the remove operation.

Examples

# In HWTACACS scheme hwt1, specify a secondary authentication server with IP address 10.163.155.13, TCP port number 49, and plaintext shared key 123456TESTauth&!.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] secondary authentication 10.163.155.13 49 key simple 123456TESTauth&!

Related commands

display hwtacacs scheme

key (HWTACACS scheme view)

primary authentication (HWTACACS scheme view)

vpn-instance (HWTACACS scheme view)

secondary authorization

Use secondary authorization to specify a secondary HWTACACS authorization server.

Use undo secondary authorization to remove a secondary HWTACACS authorization server.

Syntax

secondary authorization { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | key { cipher | simple } string | single-connection | vpn-instance vpn-instance-name ] *

undo secondary authorization [ { host-name | ipv4-address | ipv6 ipv6-address } [ port-number | vpn-instance vpn-instance-name ] * ]

Default

No secondary HWTACACS authorization servers are specified.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

host-name: Specifies the host name of a secondary HWTACACS authorization server, a case-insensitive string of 1 to 253 characters.

ipv4-address: Specifies the IPv4 address of a secondary HWTACACS authorization server.

ipv6 ipv6-address: Specifies the IPv6 address of a secondary HWTACACS authorization server.

port-number: Specifies the service port number of the secondary HWTACACS authorization server. The value range for the TCP port number is 1 to 65535. The default setting is 49.

key: Specifies the shared key for secure communication with the secondary HWTACACS authorization server.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form. For security purposes, the key specified in plaintext form will be stored in encrypted form.

string: Specifies the key. This argument is case sensitive. In non-FIPS mode, the encrypted form of the key is a string of 1 to 373 characters. The plaintext form of the key is a string of 1 to 255 characters. In FIPS mode, the encrypted form of the key is a string of 15 to 373 characters. The plaintext form of the key is a string of 15 to 255 characters. The plaintext string must contain digits, uppercase letters, lowercase letters, and special characters.

single-connection: The device and the secondary HWTACACS authorization server use the same TCP connection to exchange all authorization packets for all users. If you do not specify this keyword, the device establishes a new TCP connection each time it exchanges authorization packets with the secondary authorization server for a user.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the secondary HWTACACS authorization server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

Usage guidelines

Make sure the port number and shared key settings of the secondary HWTACACS authorization server are the same as those configured on the server.

An HWTACACS scheme supports a maximum of 16 secondary HWTACACS authorization servers. If the primary server fails, the device tries to communicate with a secondary server in active state. The device connects to the secondary servers in the order they are configured.

If you do not specify any parameters for the undo secondary authorization command, the command removes all secondary authorization servers.

Two authorization servers specified for a scheme, primary or secondary, cannot have identical VPN instance, host name, IP address, and port number settings.

As a best practice, specify the single-connection keyword to reduce TCP connections for improving system performance if the HWTACACS server supports the single-connection method.

If the specified server resides on an MPLS L3VPN, specify the VPN instance by using the vpn-instance vpn-instance-name option. The VPN instance specified by this command takes precedence over the VPN instance specified for the HWTACACS scheme.

You can remove an authorization server only when it is not used for user authorization. Removing an authorization server affects only authorization processes that occur after the remove operation.

Examples

# In HWTACACS scheme hwt1, specify a secondary authorization server with IP address 10.163.155.13, TCP port number 49, and plaintext shared key 123456TESTautr&!.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] secondary authorization 10.163.155.13 49 key simple 123456TESTautr&!

Related commands

display hwtacacs scheme

key (HWTACACS scheme view)

primary authorization (HWTACACS scheme view)

vpn-instance (HWTACACS scheme view)

stop-accounting-buffer enable (HWTACACS scheme view)

Use stop-accounting-buffer enable to enable buffering of HWTACACS stop-accounting requests to which no responses have been received.

Use undo stop-accounting-buffer enable to disable buffering of HWTACACS stop-accounting requests to which no responses have been received.

Syntax

stop-accounting-buffer enable

undo stop-accounting-buffer enable

Default

The device buffers HWTACACS stop-accounting requests to which no responses have been received.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Usage guidelines

This command enables the device to buffer an HWTACACS stop-accounting request to which no response has been received. The device resends the buffered request until it receives a server response or when the number of transmission attempts reaches the maximum (set by using the retry stop-accounting command). If no more attempts are available, the device discards the request. However, if you have removed an accounting server, stop-accounting requests destined for the server are not buffered.

Examples

# Enable buffering of HWTACACS stop-accounting requests to which no responses have been received.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] stop-accounting-buffer enable

Related commands

display stop-accounting-buffer (for HWTACACS)

reset stop-accounting-buffer (for HWTACACS)

timer quiet (HWTACACS scheme view)

Use timer quiet to set the quiet timer for the servers specified in an HWTACACS scheme.

Use undo timer quiet to restore the default.

Syntax

timer quiet minutes

undo timer quiet

Default

The server quiet period is 5 minutes.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

minutes: Specifies the server quiet period in minutes, in the range of 1 to 255.

Examples

# In HWTACACS scheme hwt1, set the server quiet timer to 10 minutes.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] timer quiet 10

Related commands

display hwtacacs scheme

timer realtime-accounting (HWTACACS scheme view)

Use timer realtime-accounting to set the real-time accounting interval.

Use undo timer realtime-accounting to restore the default.

Syntax

timer realtime-accounting minutes

undo timer realtime-accounting

Default

The real-time accounting interval is 12 minutes.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

minutes: Specifies the real-time accounting interval in minutes, in the range of 0 to 60. Setting this interval to 0 disables the device from sending online user accounting information to the HWTACACS accounting server.

Usage guidelines

For real-time accounting, a NAS must transmit the accounting information of online users to the HWTACACS accounting server periodically. This command is used to set the interval.

A short interval helps improve accounting precision but requires many system resources.

Table 16 Recommended real-time accounting intervals

Number of users

Real-time accounting interval

1 to 99

3 minutes

100 to 499

6 minutes

500 to 999

12 minutes

1000 or more

15 minutes or longer

 

When you modify the real-time accounting interval, the following rules apply to users that have been online before the modification:

·     If you modify the real-time accounting interval from a non-zero value to zero or from zero to a non-zero value, the modification does not take effect on these users. These users still use the old real-time accounting interval.

·     If you modify the real-time accounting interval from a non-zero value to another non-zero value, the modification takes effect immediately on these users.

Examples

# In HWTACACS scheme hwt1, set the real-time accounting interval to 51 minutes.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] timer realtime-accounting 51

Related commands

display hwtacacs scheme

timer response-timeout (HWTACACS scheme view)

Use timer response-timeout to set the HWTACACS server response timeout timer.

Use undo timer response-timeout to restore the default.

Syntax

timer response-timeout seconds

undo timer response-timeout

Default

The HWTACACS server response timeout time is 5 seconds.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

seconds: Specifies the HWTACACS server response timeout time, in the range of 1 to 300 seconds.

Usage guidelines

HWTACACS is based on TCP. When the server response timeout timer or the TCP timeout timer times out, the device is disconnected from the HWTACACS server.

The client timeout period of the associated access module cannot be shorter than the total response timeout timer of all HWTACACS servers in the scheme. Any violation will result in user logoffs before the authentication, authorization, or accounting process is complete.

Examples

# In HWTACACS scheme hwt1, set the HWTACACS server response timeout timer to 30 seconds.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] timer response-timeout 30

Related commands

display hwtacacs scheme

user-name-format (HWTACACS scheme view)

Use user-name-format to specify the format of the username to be sent to an HWTACACS server.

Use undo user-name-format to restore the default.

Syntax

user-name-format { keep-original | with-domain | without-domain }

undo user-name-format

Default

The ISP domain name is included in the usernames sent to an HWTACACS server.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

keep-original: Sends the username to the HWTACACS server as the username is entered.

with-domain: Includes the ISP domain name in the username sent to the HWTACACS server.

without-domain: Excludes the ISP domain name from the username sent to the HWTACACS server.

Usage guidelines

A username is generally in the userid@isp-name format, of which the isp-name argument is used by the device to determine the ISP domain to which a user belongs. However, some HWTACACS servers cannot recognize a username containing an ISP domain name. Before sending a username including a domain name to such an HWTACACS server, the device must remove the domain name. This command allows you to specify whether to include a domain name in a username to be sent to an HWTACACS server.

If an HWTACACS scheme defines that the username is sent without the ISP domain name, do not apply the scheme to more than one ISP domain. Otherwise, the HWTACACS server will consider two users in different ISP domains but with the same userid as one user.

Examples

# In HWTACACS scheme hwt1, configure the device to remove the ISP domain name from the usernames sent to the HWTACACS servers.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] user-name-format without-domain

Related commands

display hwtacacs scheme

vpn-instance (HWTACACS scheme view)

Use vpn-instance to specify an MPLS L3VPN instance for an HWTACACS scheme.

Use undo vpn-instance to restore the default.

Syntax

vpn-instance vpn-instance-name

undo vpn-instance

Default

The HWTACACS scheme belongs to the public network.

Views

HWTACACS scheme view

Predefined user roles

network-admin

Parameters

vpn-instance-name: Specifies an MPLS L3VPN instance by its name, a case-sensitive string of 1 to 31 characters.

Usage guidelines

The VPN instance specified for an HWTACACS scheme applies to all servers in that scheme. If a VPN instance is also configured for an individual HWTACACS server, the VPN instance specified for the HWTACACS scheme does not take effect on that server.

Examples

# Specify VPN instance test for HWTACACS scheme hwt1.

<Sysname> system-view

[Sysname] hwtacacs scheme hwt1

[Sysname-hwtacacs-hwt1] vpn-instance test

Related commands

display hwtacacs scheme

LDAP commands

attribute-map

Use attribute-map to specify the LDAP attribute map in an LDAP scheme.

Use undo attribute-map to restore the default.

Syntax

attribute-map map-name

undo attribute-map

Default

An LDAP scheme does not use an LDAP attribute map.

Views

LDAP scheme view

Predefined user roles

network-admin

Parameters

map-name: Specifies an LDAP attribute map by its name, a case-insensitive string of 1 to 31 characters.

Usage guidelines

When the LDAP scheme used for authorization contains an LDAP attribute map, the device converts server-assigned LDAP attributes to device-recognizable AAA attributes based on the mapping entries.

You can specify only one LDAP attribute map in an LDAP scheme. If you execute this command multiple times, the most recent configuration takes effect.

If you specify another attribute map or change the mapping entries, the new settings take effect only on the LDAP authorization that occurs after your operation.

Examples

# Specify LDAP attribute map map1 in LDAP scheme test.

<Sysname> system-view

[Sysname] ldap scheme test

[Sysname-ldap-test] attribute-map map1

Related commands

display ldap-scheme

ldap attribute-map

authentication-server

Use authentication-server to specify the LDAP authentication server for an LDAP scheme.

Use undo authentication-server to restore the default.

Syntax

authentication-server server-name

undo authentication-server

Default

No LDAP authentication server is specified for an LDAP scheme.

Views

LDAP scheme view

Predefined user roles

network-admin

Parameters

server-name: Specifies the name of an LDAP server, a case-insensitive string of 1 to 64 characters.

Usage guidelines

You can specify only one LDAP authentication server in an LDAP scheme. If you execute this command multiple times, the most recent configuration takes effect.

Examples

# In LDAP scheme ldap1, specify the LDAP authentication server as ccc.

<Sysname> system-view

[Sysname] ldap scheme ldap1

[Sysname-ldap-ldap1] authentication-server ccc

Related commands

display ldap scheme

ldap server

authorization-server

Use authorization-server to specify the LDAP authorization server for an LDAP scheme.

Use undo authorization-server to restore the default.

Syntax

authorization-server server-name

undo authorization-server

Default

No LDAP authorization server is specified for an LDAP scheme.

Views

LDAP scheme view

Predefined user roles

network-admin

Parameters

server-name: Specifies the name of an LDAP server, a case-insensitive string of 1 to 64 characters.

Usage guidelines

You can specify only one LDAP authorization server in an LDAP scheme. If you execute this command multiple times, the most recent configuration takes effect.

Examples

# In LDAP scheme ldap1, specify the LDAP authorization server as ccc.

<Sysname> system-view

[Sysname] ldap scheme ldap1

[Sysname-ldap-ldap1] authorization-server ccc

Related commands

display ldap scheme

ldap server

display ldap scheme

Use display ldap scheme to display LDAP scheme configuration.

Syntax

display ldap scheme [ ldap-scheme-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

ldap-scheme-name: Specifies an LDAP scheme by its name, a case-insensitive string of 1 to 32 characters. If you do not specify an LDAP scheme, this command displays the configuration of all LDAP schemes.

Examples

# Display the configuration of all LDAP schemes.

<Sysname> display ldap scheme

Total 1 LDAP schemes

 

------------------------------------------------------------------

LDAP scheme name             : aaa

  Authentication server      : aaa

    IP                       : 1.1.1.1

    Port                     : 111

    VPN instance             : Not configured

    LDAP protocol version    : LDAPv3

    Server timeout interval  : 10 seconds

    Login account DN         : Not configured

    Base DN                  : Not configured

    Search scope             : all-level

    User searching parameters:

      User object class      : Not configured

      Username attribute     : cn

      Username format        : with-domain

  Authorization server       : aaa

    IP                       : 1.1.1.1

    Port                     : 111

    VPN instance             : Not configured

    LDAP protocol version    : LDAPv3

    Server timeout interval  : 10 seconds

    Login account DN         : Not configured

    Base DN                  : Not configured

    Search scope             : all-level

    User searching parameters:

      User object class      : Not configured

      Username attribute     : cn

      Username format        : with-domain

  Attribute map              : map1

 ------------------------------------------------------------------

Table 17 Command output

Field

Description

Authentication server

Name of the LDAP authentication server. If no server is configured, this field displays Not configured.

Authorization server

Name of the LDAP authorization server. If no server is configured, this field displays Not configured.

IP

IP address of the LDAP server. If no server is specified, this field displays Not configured.

Port

Port number of the server. If no port number is specified, this field displays the default port number.

VPN instance

MPLS L3VPN instance to which the LDAP server belongs. If no VPN instance is specified, this field displays Not configured.

LDAP protocol version

LDAP version, LDAPv2 or LDAPv3.

Server timeout interval

LDAP server timeout period, in seconds.

Login account DN

DN of the administrator.

Base DN

Base DN for user search.

Search scope

User DN search scope, including:

·     all-level—All subdirectories.

·     single-level—Next lower level of subdirectories under the base DN.

User searching parameters

User search parameters.

User object class

User object class for user DN search. If no user object class is configured, this field displays Not configured.

Username attribute

User account attribute for login.

Username format

Format for the username sent to the server.

Attribute map

LDAP attribute map used by the scheme. If no LDAP attribute map is used, this field displays Not configured.

 

ip

Use ip to configure the IP address of the LDAP server.

Use undo ip to restore the default.

Syntax

ip ip-address [ port port-number ] [ vpn-instance vpn-instance-name ]

undo ip

Default

An LDAP server does not have an IP address.

Views

LDAP server view

Predefined user roles

network-admin

Parameters

ip-address: Specifies the IP address of the LDAP server.

port port-number: Specifies the TCP port number of the LDAP server. The value range for the port-number argument is 1 to 65535, and the default value is 389.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the LDAP server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

Usage guidelines

The LDAP service port configured on the device must be consistent with the service port of the LDAP server.

If you change the IP address and port number of the LDAP server, the change takes effect only on the LDAP authentication that occurs after the change.

Examples

# Specify the IP address and port number as 192.168.0.10 and 4300 for LDAP server ccc.

<Sysname> system-view

[Sysname] ldap server ccc

[Sysname-ldap-server-ccc] ip 192.168.0.10 port 4300

Related commands

ldap server

ipv6

Use ipv6 to configure the IPv6 address of the LDAP server.

Use undo ipv6 to restore the default.

Syntax

ipv6 ipv6-address [ port port-number ] [ vpn-instance vpn-instance-name ]

undo ipv6

Default

An LDAP server does not have an IPv6 address.

Views

LDAP server view

Predefined user roles

network-admin

Parameters

ipv6-address: Specifies the IPv6 address of the LDAP server.

port port-number: Specifies the TCP port number of the LDAP server. The value range for the port-number argument is 1 to 65535, and the default value is 389.

vpn-instance vpn-instance-name: Specifies an MPLS L3VPN instance to which the LDAP server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the server is on the public network, do not specify this option.

Usage guidelines

The LDAP service port configured on the device must be consistent with the service port of the LDAP server.

If you change the IP address and port number of the LDAP server, the change takes effect only on the LDAP authentication that occurs after the change.

Examples

# Specify the IPv6 address and port number as 1:2::3:4 and 4300 for LDAP server ccc.

<Sysname> system-view

[Sysname] ldap server ccc

[Sysname-ldap-server-ccc] ipv6 1:2::3:4 port 4300

Related commands

ldap server

ldap attribute-map

Use ldap attribute-map to create an LDAP attribute map and enter its view, or enter the view of an existing LDAP attribute map.

Use undo ldap attribute-map to delete an LDAP attribute map.

Syntax

ldap attribute-map map-name

undo ldap attribute-map map-name

Default

No LDAP attribute maps exist.

Views

System view

Predefined user roles

network-admin

Parameters

map-name: Specifies the name of the LDAP attribute map, a case-insensitive string of 1 to 31 characters.

Usage guidelines

Execute this command multiple times to create multiple LDAP attribute maps. You can add multiple mapping entries to an LDAP attribute map. Each entry defines the mapping between an LDAP attribute and an AAA attribute.

Examples

# Create an LDAP attribute map named map1 and enter LDAP attribute map view.

<Sysname> system-view

[Sysname] ldap attribute-map map1

[Sysname-ldap-map-map1]

Related commands

attribute-map

ldap scheme

map

ldap scheme

Use ldap scheme to create an LDAP scheme and enter its view, or enter the view of an existing LDAP scheme.

Use undo ldap scheme to delete an LDAP scheme.

Syntax

ldap scheme ldap-scheme-name

undo ldap scheme ldap-scheme-name

Default

No LDAP schemes exist.

Views

System view

Predefined user roles

network-admin

Parameters

ldap-scheme-name: Specifies the LDAP scheme name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

An LDAP scheme can be used by more than one ISP domain at the same time.

You can configure a maximum of 16 LDAP schemes.

Examples

# Create an LDAP scheme named ldap1 and enter LDAP scheme view.

<Sysname> system-view

[Sysname] ldap scheme ldap1

[Sysname-ldap-ldap1]

Related commands

display ldap scheme

ldap server

Use ldap server to create an LDAP server and enter its view, or enter the view of an existing LDAP server.

Use undo ldap server to delete an LDAP server.

Syntax

ldap server server-name

undo ldap server server-name

Default

No LDAP servers exist.

Views

System view

Predefined user roles

network-admin

Parameters

server-name: Specifies the LDAP server name, a case-insensitive string of 1 to 64 characters.

Examples

# Create an LDAP server named ccc and enter LDAP server view.

<Sysname> system-view

[Sysname] ldap server ccc

[Sysname-ldap-server-ccc]

Related commands

display ldap scheme

login-dn

Use login-dn to specify the administrator DN.

Use undo login-dn to restore the default.

Syntax

login-dn dn-string

undo login-dn

Default

No administrator DN is specified.

Views

LDAP server view

Predefined user roles

network-admin

Parameters

dn-string: Specifies the administrator DN for binding with the server, a case-insensitive string of 1 to 255 characters.

Usage guidelines

The administrator DN specified on the device must be consistent with the administrator DN configured on the LDAP server.

If you change the administrator DN, the change takes effect only on the LDAP authentication that occurs after the change.

Examples

# Specify the administrator DN as uid=test, ou=people, o=example, c=city for LDAP server ccc.

<Sysname> system-view

[Sysname] ldap server ccc

[Sysname-ldap-server-ccc] login-dn uid=test,ou=people,o=example,c=city

Related commands

display ldap scheme

login-password

Use login-password to configure the administrator password for binding with the LDAP server during LDAP authentication.

Use undo login-password to restore the default.

Syntax

login-password { cipher | simple } string

undo login-password

Default

No administrator password is configured.

Views

LDAP server view

Predefined user roles

network-admin

Parameters

cipher: Specifies a password in encrypted form.

simple: Specifies a password in plaintext form. For security purposes, the password specified in plaintext form will be stored in encrypted form.

string: Specifies the password. Its plaintext form is a case-sensitive string of 1 to 128 characters. Its encrypted form is a case-sensitive string of 1 to 201 characters.

Usage guidelines

This command takes effect only after the login-dn command is used.

Examples

# Specify the administrator password as abcdefg in plaintext form for LDAP server ccc.

<Sysname> system-view

[Sysname] ldap server ccc

[Sysname-ldap-server-ccc] login-password simple abcdefg

Related commands

display ldap scheme

login-dn

map

Use map to configure a mapping entry in an LDAP attribute map.

Use undo map to delete the specified mapping entries from the LDAP attribute map.

Syntax

map ldap-attribute ldap-attribute-name [ prefix prefix-value delimiter delimiter-value ] aaa-attribute { user-group | user-profile }

undo map [ ldap-attribute ldap-attribute-name ]

Default

An LDAP attribute map does not contain mapping entries.

Views

LDAP attribute map view

Predefined user roles

network-admin

Parameters

ldap-attribute ldap-attribute-name: Specifies an LDAP attribute by its name. The ldap-attribute-name argument is a case-insensitive string of 1 to 63 characters.

prefix prefix-value delimiter delimiter-value: Specifies a partial value string of the LDAP attribute for attribute mapping. The prefix-value argument represents the position where the partial string starts. The prefix is a case-insensitive string of 1 to 7 characters, such as cn=. The delimiter-value argument represents the position where the partial string ends, such as a comma (,). If you do not specify the prefix prefix-value delimiter delimiter-value option, the mapping entry uses the entire value string of the LDAP attribute.

aaa-attribute: Specifies an AAA attribute.

user-group: Specifies the user group attribute.

user-profile: Specifies the user profile attribute.

Usage guidelines

Because the device ignores unrecognized LDAP attributes, configure the mapping entries to include important LDAP attributes that should not be ignored.

An LDAP attribute can be mapped only to one AAA attribute. Different LDAP attributes can be mapped to the same AAA attribute.

If you do not specify an LDAP attribute for the undo map command, the command deletes all mapping entries from the LDAP attribute map.

Examples

# In LDAP attribute map map1, map a partial value string of the LDAP attribute named memberof to AAA attribute named user-group.

<Sysname> system-view

[Sysname] ldap attribute-map map1

[Sysname-ldap-map-map1] map ldap-attribute memberof prefix cn= delimiter , aaa-attribute user-group

Related commands

ldap attribute-map

user-group

user-profile

protocol-version

Use protocol-version to specify the LDAP version.

Use undo protocol-version to restore the default.

Syntax

protocol-version { v2 | v3 }

undo protocol-version

Default

The LDAP version is LDAPv3.

Views

LDAP server view

Predefined user roles

network-admin

Parameters

v2: Specifies the LDAP version LDAPv2.

v3: Specifies the LDAP version LDAPv3.

Usage guidelines

For successful LDAP authentication, the LDAP version used by the device must be consistent with the version used by the LDAP server.

If you change the LDAP version, the change takes effect only on the LDAP authentication that occurs after the change.

A Microsoft LDAP server supports only LDAPv3.

Examples

# Specify the LDAP version as LDAPv2 for LDAP server ccc.

<Sysname> system-view

[Sysname] ldap server ccc

[Sysname-ldap-server-ccc] protocol-version v2

Related commands

display ldap scheme

search-base-dn

Use search-base-dn to specify the base DN for user search.

Use undo search-base-dn to restore the default.

Syntax

search-base-dn base-dn

undo search-base-dn

Default

No base DN is specified for user search.

Views

LDAP server view

Predefined user roles

network-admin

Parameters

base-dn: Specifies the base DN for user search, a case-insensitive string of 1 to 255 characters.

Examples

# Specify the base DN for user search as dc=ldap,dc=com for LDAP server ccc.

<Sysname> system-view

[Sysname] ldap server ccc

[Sysname-ldap-server-ccc] search-base-dn dc=ldap,dc=com

Related commands

display ldap scheme

ldap server

search-scope

Use search-scope to specify the user search scope.

Use undo search-scope to restore the default.

Syntax

search-scope { all-level | single-level }

undo search-scope

Default

The user search scope is all-level.

Views

LDAP server view

Predefined user roles

network-admin

Parameters

all-level: Specifies that the search goes through all subdirectories of the base DN.

single-level: Specifies that the search goes through only the next lower level of subdirectories under the base DN.

Examples

# Specify the search scope for the LDAP authentication as all subdirectories of the base DN for LDAP server ccc.

<Sysname> system-view

[Sysname] ldap server ccc

[Sysname-ldap-server-ccc] search-scope all-level

Related commands

display ldap scheme

ldap server

server-timeout

Use server-timeout to set the LDAP server timeout period, the maximum time that the device waits for an LDAP response.

Use undo server-timeout to restore the default.

Syntax

server-timeout time-interval

undo server-timeout

Default

The LDAP server timeout period is 10 seconds.

Views

LDAP server view

Predefined user roles

network-admin

Parameters

time-interval: Specifies the LDAP server timeout period in the range of 5 to 20 seconds.

Usage guidelines

If you change the LDAP server timeout period, the change takes effect only on the LDAP authentication that occurs after the change.

Examples

# Set the LDAP server timeout period to 15 seconds for LDAP server ccc.

<Sysname> system-view

[Sysname] ldap server ccc

[Sysname-ldap-server-ccc] server-timeout 15

Related commands

display ldap scheme

user-parameters

Use user-parameters to configure LDAP user attributes, including the username attribute, username format, and user-defined user object class.

Use undo user-parameters to restore the default of an LDAP user attribute.

Syntax

user-parameters { user-name-attribute { name-attribute | cn | uid } | user-name-format { with-domain | without-domain } | user-object-class object-class-name }

undo user-parameters { user-name-attribute | user-name-format | user-object-class }

Default

The LDAP username attribute is cn and the username format is without-domain. No user object class is specified and the default user object class of the LDAP server is used.

Views

LDAP server view

Predefined user roles

network-admin

Parameters

user-name-attribute { name-attribute | cn | uid }: Specifies the username attribute. The name-attribute argument represents an attribute value, a case-insensitive string of 1 to 64 characters. The cn keyword represents the user account attribute of common name, and the uid keyword represents the user account attribute of user ID.

user-name-format { with-domain | without-domain }: Specifies the format of the username to be sent to the server. The with-domain keyword means that the username contains the domain name, and the without-domain keyword means that the username does not contain the domain name.

user-object-class object-class-name: Specifies the user object class for user search. The object-class-name argument represents a class value, a case-insensitive string of 1 to 64 characters.

Usage guidelines

If the username on the LDAP server does not contain the domain name, specify the without-domain keyword. If the username contains the domain name, specify the with-domain keyword.

Examples

# Set the user object class to person for LDAP server ccc.

<Sysname> system-view

[Sysname] ldap server ccc

[Sysname-ldap-server-ccc] user-parameters user-object-class person

Related commands

display ldap scheme

login-dn

RADIUS server commands

display radius-server active-client

Use display radius-server active-client to display information about activated RADIUS clients.

Syntax

display radius-server active-client

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display information about all activated RADIUS clients.

<Sysname> display radius-server active-client

Total 2 RADIUS clients.

Client IP: 2.2.2.2

Client IP: 3.3.3.3

Related commands

radius-server client

display radius-server active-user

Use display radius-server active-user to display information about activated RADIUS users.

Syntax

display radius-server active-user [ user-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

user-name: Specifies a RADIUS user name, a case-sensitive string of 1 to 55 characters. The name must meet the following requirements:

·     Cannot contain a domain name.

·     Cannot contain any of the following characters: forward slash (/), backslash (\), vertical bar (|), colon (:), asterisk (*), question mark (?), left angle bracket (<), right angle bracket (>), or at sign (@).

·     Cannot be a, al, or all.

If you do not specify a RADIUS user name, this command displays information about all RADIUS users.

Examples

# Display information about the activated RADIUS user named test.

<Sysname> display radius-server active-user test

Total 1 RADIUS users matched.

 

Username: test

  Description: A network access user from company cc

  Authorization attributes:

    VLAN ID: 2

    ACL number: 2000

  Validity period:

    Expiration time: 2015/04/03-18:00:00

# Display information about all activated RADIUS users.

<Sysname> display radius-server active-user

Total 2 RADIUS users matched.

 

Username: 123

  Description: A network access user from company cc

  Authorization attributes:

    VLAN ID: 2

    ACL number: 3000

  Validity period:

    Expiration time: 2016/04/03-18:00:00

 

Username: 456

  Description: A network access user from company cc

  Authorization attributes:

    VLAN ID: 2

    ACL number: 3000

  Validity period:

    Expiration time: 2016/04/03-18:00:00

Table 18 Command output

Field

Description

Username

RADIUS user name.

Description

Description of the RADIUS user.

Authorization attributes

Authorization attributes of the RADIUS user.

VLAN ID

Authorization VLAN.

ACL number

Authorization ACL.

Validity period

Validity time period of the RADIUS user.

Expiration time

Expiration date and time.

 

Related commands

local-user

radius-server activate

Use radius-server activate to activate the RADIUS server configuration, including RADIUS clients and users.

Syntax

radius-server activate

Views

System view

Predefined user roles

network-admin

Usage guidelines

Use this command to immediately activate the most recent RADIUS server configuration after you have added, modified, or deleted RADIUS clients and network access users from which RADIUS user data is generated.

Executing this command restarts the RADIUS server process and an authentication service interruption will occur during the restart.

Examples

# Activate the RADIUS server configuration.

<Sysname> system-view

[Sysname] radius-server activate

Related commands

display radius-server active-client

display radius-server active-user

radius-server client

Use radius-server client to configure a RADIUS client.

Use undo radius-server client to delete a RADIUS client.

Syntax

radius-server client ip ipv4-address key { cipher | simple } string

undo radius-server client { all | ip ipv4-address }

Default

No RADIUS clients are specified.

Views

System view

Predefined user roles

network-admin

Parameters

ip ipv4-address: Specifies the IPv4 address of the RADIUS client, which must be a Class A, B, or C address and the first octet cannot be 0 or 127.

key: Specifies the shared key to communicate with the RADIUS client.

cipher: Specifies the key in encrypted form.

simple: Specifies the key in plaintext form.

string: Specifies a case-sensitive key string. The encrypted form of the key is a string of 1 to 117 characters. The plaintext form of the key is a string of 1 to 64 characters.

all: Specifies all RADIUS clients.

Usage guidelines

The IP address of a RADIUS client must be the same as the source IP address for outgoing RADIUS packets specified on the RADIUS client.

The shared key of a RADIUS client must be the same as the setting on the RADIUS client.

Execute this command multiple times to configure multiple RADIUS clients.

Examples

# Configure a RADIUS client whose IP address is 2.2.2.2 and shared key is test in plaintext.

<Sysname> system-view

[Sysname] radius-server client ip 2.2.2.2 key simple test

Related commands

display radius-server active-client

Connection recording policy commands

aaa connection-recording policy

Use aaa connection-recording policy to create a connection recording policy and enter its view, or enter the view of an existing connection recording policy.

Use aaa connection-recording policy to delete the connection recording policy.

Syntax

aaa connection-recording policy

undo aaa connection-recording policy

Default

The connection recording policy does not exist.

Views

System view

Predefined user roles

network-admin

Usage guidelines

Use this feature on scenarios where the device acts as an FTP, SSH, SFTP, or Telnet login client to establish a connection with a login server. This feature enables the device to provide an accounting server with the connection start and termination information. When the login client establishes a connection with the login server, the system sends a start-accounting request to the accounting server. When the connection is terminated, the system sends a stop-accounting request to the accounting server.

Examples

# Create a connection recording policy and enter its view.

<Sysname> system-view

[Sysname] aaa connection-recording policy

[sysname-connection-recording-policy]

Related commands

accounting hwtacacs-scheme

display aaa connection-recording policy

accounting hwtacacs-scheme

Use accounting hwtacacs-scheme to specify the accounting method for the connection recording policy.

Use undo accounting to restore the default.

Syntax

accounting hwtacacs-scheme hwtacacs-scheme-name

undo accounting

Default

No accounting method is specified for the connection recording policy. No accounting is performed on the connections initiated by the device as a login client.

Views

Connection recording policy view

Predefined user roles

network-admin

Parameters

hwtacacs-scheme-name: Specifies an HWTACACS scheme by its name, a case-insensitive string of 1 to 32 characters.

Usage guidelines

If the accounting method is changed, the new method takes effect only on subsequent connections initiated by the device as a login client.

For a connection, once the device sends the start-accounting request to an HWTACACS server, it sends the connection's stop-accounting packet to the same server.

If you execute this command multiple times, the most recent configuration takes effect.

The device includes the username entered by a user in the accounting packets to be sent to the AAA server for connection recording. The username format configured by using the user-name-format command in the accounting scheme does not take effect.

Examples

# Create a connection recording policy, and specify HWTACACS scheme tac as the accounting method.

<Sysname> system-view

[Sysname] aaa connection-recording policy

[sysname-connection-recording-policy] accounting hwtacacs-scheme tac

Related commands

aaa connection-recording policy

display aaa connection-recording policy

display aaa connection-recording policy

Use display aaa connection-recording policy to display the connection recording policy configuration.

Syntax

display aaa connection-recording policy

Views

Any view

Predefined user roles

network-admin

network-operator

Examples

# Display the connection recording policy configuration.

<Sysname> display aaa connection-recording policy

Connection-recording policy:

  Accounting scheme: HWTACACS=tac1

Related commands

aaa connection-recording policy

accounting hwtacacs-scheme

 

  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
All Support
  • Become a Partner
  • Partner Resources
  • Partner Business Management
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us
新华三官网