HP FlexFabric 5700 Series Security Configuration Manual page 47

Specifying the shared keys for secure HWTACACS communication
The HWTACACS client and server use the MD5 algorithm and shared keys to generate the Authenticator
value for packet authentication and user password encryption. The client and server must use the same
key for each type of communication.
Perform this task to configure shared keys for servers in an HWTACACS scheme. The keys take effect on
all servers for which a shared key is not individually configured.
To specify a shared key for secure HWTACACS communication:
Step
1. Enter system view.
2. Enter HWTACACS scheme
view.
3. Specify a shared key for
secure HWTACACS
authentication, authorization,
or accounting
communication.
Setting the username format and traffic statistics units
A username is in the userid@isp-name format, where the isp-name argument represents the user's ISP
domain name. By default, the ISP domain name is included in a username. If HWTACACS servers do not
recognize usernames that contain ISP domain names, you can configure the device to send usernames
without domain names to the servers.
If two or more ISP domains use the same HWTACACS scheme, configure the HWTACACS scheme to
keep the ISP domain name in usernames for domain identification.
The device reports online user traffic statistics in accounting packets. The traffic measurement units are
configurable, but they must be the same as the traffic measurement units configured on the HWTACACS
accounting servers.
To set the username format and traffic statistics units for an HWTACACS scheme:
Step
1. Enter system view.
2. Enter HWTACACS scheme
view.
3. Set the format of usernames
sent to the HWTACACS
servers.
4. (Optional.) Set the data flow
and packet measurement
units for traffic statistics.
Command
system-view
hwtacacs scheme
hwtacacs-scheme-name
key { accounting | authentication |
authorization } { cipher | simple }
string
Command
system-view
hwtacacs scheme
hwtacacs-scheme-name
user-name-format { keep-original |
with-domain | without-domain }
data-flow-format { data { byte |
giga-byte | kilo-byte | mega-byte }
| packet { giga-packet | kilo-packet
| mega-packet | one-packet } }*
35
Remarks
N/A
N/A
By default, no shared key is
specified.
The shared key configured on the
device must be the same as the
shared key configured on the
HWTACACS server.
Remarks
N/A
N/A
By default, the ISP domain name
is included in a username.
By default, traffic is counted in
bytes and packets.