HP VSR1000 Security Configuration Manual page 42

Step
3. Specify a security policy
server.
Interpreting the RADIUS class attribute as CAR parameters
A RADIUS server might deliver CAR parameters for user-based traffic monitoring and control by using the
RADIUS class attribute (attribute 25). You can configure the device to interpret the class attribute to CAR
parameters in the RADIUS packets to be forwarded to users.
To configure the device to interpret the RADIUS class attribute as CAR parameters:
Step
1. Enter system view.
2. Enter RADIUS scheme view.
3. Interpret the RADIUS class
attribute as CAR parameters.
Configuring the service consistency check mode for SSH, FTP, and terminal users
A service consistency check is performed when the device receives an Access-Accept packet for a user.
The check is passed if the value of the Login-Service attribute (attribute 15) in the packet matches the
service type of the user.
Service types comply with the standard Login-Service attributes in RFC 2865. The device also supports
SSH, FTP, and terminal services, which are extended Login-Service attributes using the following values:
50—Represents the SSH service.
•
51—Represents the FTP service.
•
• 52—Represents the terminal service.
To assign correct login services to SSH, FTP, and terminal users, the server must support the extended
Login-Service attributes.
If extended attributes are not supported on the server, the device provides a loose check mode for SSH,
FTP, and terminal users. In this mode, the service types of all SSH, FTP, and terminal users match the Telnet
login service. To support the loose check mode, the server must assign the Telnet service in the
Login-Service attribute with a value of 0.
Use the loose check mode only when the server does not issue the extended Login-Service attribute
values for SSH, FTP, and terminal users.
To configure the service consistency check mode for SSH, FTP, and terminal users:
Step
1. Enter system view.
2. Enter RADIUS scheme
view.
Command
security-policy-server { ipv4-address
| ipv6 ipv6-address } [ vpn-instance
vpn-instance-name ]
Command
system-view
radius scheme
radius-scheme-name
attribute 25 car
Command
system-view
radius scheme radius-scheme-name
32
Remarks
By default, no security policy server
is specified for a scheme.
You can specify up to eight security
policy servers for a RADIUS scheme.
Remarks
N/A
N/A
By default, the RADIUS class attribute is
not interpreted.
Remarks
N/A
N/A