HP MSR Series Configuration Manual page 47

•
Real-time accounting timer (realtime-accounting)—Defines the interval at which the device
sends real-time accounting packets to the RADIUS accounting server for online users.
When you set RADIUS timers, follow these guidelines:
•
When you configure the maximum number of RADIUS packet transmission attempts and the
RADIUS server response timeout timer, consider the number of secondary servers. If the
retransmission process takes too much time, the client connection in the access module (for
example, Telnet) might time out during the process.
•
When a number of secondary servers are configured, the client connections of access modules
that have a short client connection timeout period might still be timed out during initial
authentication or accounting, even if the packet transmission attempt limit and server response
timeout period are configured with small values. However, the next authentication or accounting
attempt can succeed, because the device has set the unreachable servers to blocked, which
shortens the amount of time for finding a reachable server.
•
Make sure the server quiet timer is set correctly. A timer that is too short might result in frequent
authentication or accounting failures. This is because the device will continue to attempt to
communicate with an unreachable server that is in active state. A timer that is too long might
temporarily block a reachable server that has recovered from a failure. This is because the
server will remain in blocked state until the timer expires.
•
A short real-time accounting interval helps improve accounting precision but requires many
system resources. When there are 1000 or more users, set the interval to 15 minutes or longer.
To set RADIUS timers:
Step
1. Enter system view.
2. Enter RADIUS scheme view.
3. Set the RADIUS server
response timeout timer.
4. Set the quiet timer for the
servers.
5. Set the real-time accounting
timer.
Enabling the accounting-on feature
The accounting-on feature enables the device to automatically send an accounting-on packet to the
RADIUS server after a device or card reboot. Upon receiving the accounting-on packet, the RADIUS
server logs out all online users who log in through the device or card. Without this feature, users
cannot log in again after the device or card reboot, because the RADIUS server considers them to
come online.
You can configure the interval for which the device waits to resend the accounting-on packet and the
maximum number of retries.
The RADIUS server must run on IMC to correctly log out users when a card reboots on the
distributed device to which the users connect.
To enable the accounting-on feature for a RADIUS scheme:
Step
1. Enter system view.
2. Enter RADIUS scheme view.
Command
system-view
radius scheme
radius-scheme-name
timer response-timeout
seconds
timer quiet minutes
timer realtime-accounting
minutes interval [ second ]
Command
system-view
radius scheme
radius-scheme-name
32
Remarks
N/A
N/A
The default setting is 3 seconds.
The default setting is 5 minutes.
The default setting is 12 minutes.
Remarks
N/A
N/A