HP 3600 v2 Series Security Configuration Manual page 48

To do...
Enter HWTACACS scheme view
Set the format for usernames sent
to the HWTACACS servers
Specify the unit for data flows or
packets sent to the HWTACACS
servers
NOTE:
• If an HWTACACS server does not support a username that carries the domain name, configure the
switch to remove the domain name before sending the username to the server.
For level switching authentication, the user-name-format keep-original and user-name-format
•
without-domain commands produce the same results: they make sure that usernames sent to the
HWTACACS server carry no ISP domain name.
Specifying a source IP address for outgoing HWTACACS packets
The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS
configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon
receiving an HWTACACS packet, an HWTACACS server checks whether the source IP address of the
packet is the IP address of any managed NAS. If yes, the server processes the packet. If not, the server
drops the packet.
Usually, the source address of outgoing HWTACACS packets can be the IP address of the NAS's any
interface that can communicate with the HWTACACS server. In some special scenarios, however, you
must change the source IP address. For example, if a Network Address Translation (NAT) device is
present between the NAS and the HWTACACS server, the source IP address of outgoing HWTACACS
packets must be a public IP address of the NAS. If the NAS is configured with the Virtual Router
Redundancy Protocol (VRRP) for stateful failover, the source IP address of HWTACACS packets can be
the virtual IP address of the VRRP group that the uplink belongs to.
You can specify the source IP address for outgoing HWTACACS packets in HWTACACS scheme view for
a specific HWTACACS scheme, or in system view for all HWTACACS schemes whose servers are in a
VPN or the public network.
Before sending an HWTACACS packet, a NAS selects a source IP address in this order:
The source IP address specified for the HWTACACS scheme.
1.
The source IP address specified in system view for the VPN or public network, depending on where
2.
the HWTACACS server resides.
The IP address of the outbound interface specified by the route.
3.
Follow these steps to specify a source IP address for all HWTACACS schemes of a VPN or the public
network:
To do...
Enter system view
Use the command...
hwtacacs scheme
hwtacacs-scheme-name
user-name-format { keep-original |
with-domain | without-domain }
data-flow-format { data { byte |
giga-byte | kilo-byte | mega-byte }
| packet { giga-packet | kilo-packet
| mega-packet | one-packet } }*
Use the command...
system-view
37
Remarks
—
Optional
By default, the ISP domain name
is included in a username.
Optional
byte for data flows and
one-packet for data packets by
default.
Remarks
—