HP VSR1000 Security Configuration Manual page 39

Step
2. Enter RADIUS scheme view.
3. Set the RADIUS server status.
Specifying the source IP address for outgoing RADIUS packets
The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS
configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a
RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of
a managed NAS.
If it is the IP address of a managed NAS, the server processes the packet.
•
• If it is not the IP address of a managed NAS, the server drops the packet.
The source address of outgoing RADIUS packets is typically the IP address of an egress interface on the
NAS to communicate with the RADIUS server. However, in some situations, you must change the source
IP address. For example, when VRRP is configured for stateful failover, configure the virtual IP address of
the uplink VRRP group as the source IP address.
You can specify a source IP address for outgoing RADIUS packets in RADIUS scheme view or in system
view:
The IP address specified in RADIUS scheme view applies only to one RADIUS scheme.
•
• The IP address specified in system view applies to all RADIUS schemes whose servers are in a VPN
or the public network.
Before sending a RADIUS packet, the NAS selects a source IP address in the following order:
1. The source IP address specified for the RADIUS scheme.
2. The source IP address specified in system view for the VPN or public network, depending on where
the RADIUS server resides.
3. The IP address of the outbound interface specified by the route.
To specify a source IP address for all RADIUS schemes in a VPN or the public network:
Command
radius scheme radius-scheme-name
•
Set the status of the primary RADIUS
authentication server:
state primary authentication { active |
block }
•
Set the status of the primary RADIUS
accounting server:
state primary accounting { active |
block }
•
Set the status of a secondary RADIUS
authentication server:
state secondary authentication
[ ip-address [ port-number |
vpn-instance vpn-instance-name ] * ]
{ active | block }
•
Set the status of a secondary RADIUS
accounting server:
state secondary accounting
[ ip-address [ port-number |
vpn-instance vpn-instance-name ] * ]
{ active | block }
29
Remarks
N/A
Configure at least one
command.
By default, every server
specified in a RADIUS scheme
is in active state.
The configured server status
cannot be saved to any
configuration file, and can
only be viewed by using the
display radius scheme
command. After the device
restarts, all servers are
restored to the active state.