HP A6600 Configuration Manual page 50

Specifying a source IP address for outgoing HWTACACS packets
The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS
configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon
receiving an HWTACACS packet, an HWTACACS server checks whether the source IP address of the
packet is the IP address of any managed NAS. If it is, the server processes the packet. If it is not, the
server drops the packet.
Usually, the source address of outgoing HWTACACS packets can be the IP address of any interface of
the NAS that can communicate with the HWTACACS server. In some special scenarios, however, you
must change the source IP address. For example, if a NAT device is present between the NAS and the
HWTACACS server, the source IP address of outgoing HWTACACS packets must be a public IP address
of the NAS. If the NAS is configured with the VRRP for stateful failover, the source IP address of
HWTACACS packets can be the virtual IP address of the uplink's VRRP group.
Specify the source IP address for outgoing HWTACACS packets in HWTACACS scheme view for a
specific HWTACACS scheme, or in system view for all HWTACACS schemes whose servers are in a
VPN or the public network.
Before sending an HWTACACS packet, a NAS selects a source IP address in this order:
The source IP address specified for the HWTACACS scheme.
1.
The source IP address specified in system view for the VPN or public network, depending on where
2.
the HWTACACS server resides.
The IP address of the outbound interface specified by the route.
3.
To specify a source IP address for all HWTACACS schemes of a VPN or the public network:
To do...
1. Enter system view.
2. Specify a source IP
address for outgoing
HWTACACS packets.
To specify a source IP address for a specific HWTACACS scheme:
To do...
1. Enter system view.
2. Enter HWTACACS
scheme view.
3. Specify a source IP
address for outgoing
HWTACACS packets.
Setting timers for controlling communication with HWTACACS servers
The router uses the following timers to control the communication with an HWTACACS server:
Server response timeout timer (response-timeout)—Defines the HWTACACS request retransmission
•
interval. After sending an HWTACACS request (authentication, authorization, or accounting
request), the router starts this timer. If the router receives no response from the server before this
timer expires, it resends the request.
Server quiet timer (quiet)—Defines the duration to keep an unreachable server in the blocked state.
•
If a server is not reachable, the router changes the server's status to blocked, starts this timer for the
Command...
system-view
hwtacacs nas-ip ip-address [
vpn-instance vpn-instance-
name ]
Command...
system-view
hwtacacs scheme hwtacacs-
scheme-name
nas-ip ip-address
38
Remarks
—
Required.
By default, the IP address of the outbound
interface is used as the source IP address.
Remarks
—
—
Required.
By default, the IP address of the outbound
interface is used as the source IP address.