HP ProCurve 9304M Security Manual page 61

Securing Access to Management Functions
NOTE: Encryption of the RADIUS keys is done by default. The 0 parameter disables encryption. The 1
parameter is not required; it is provided for backwards compatibility.
Setting the Retransmission Limit
The retransmit parameter specifies the maximum number of retransmission attempts. When an authentication
request times out, the HP software will retransmit the request up to the maximum number of retransmissions
configured. The default retransmit value is 3 retries. The range of retransmit values is from 1 – 5.
To set the RADIUS retransmit limit:
ProCurveRS(config)# radius-server retransmit 5
Syntax: radius-server retransmit <number>
Setting the Timeout Parameter
The timeout parameter specifies how many seconds the HP device waits for a response from the RADIUS server
before either retrying the authentication request, or determining that the RADIUS server is unavailable and moving
on to the next authentication method in the authentication-method list. The timeout can be from 1 – 15 seconds.
The default is 3 seconds.
ProCurveRS(config)# radius-server timeout 5
Syntax: radius-server timeout <number>
Configuring Authentication-Method Lists for RADIUS
You can use RADIUS to authenticate Telnet/SSH access and access to Privileged EXEC level and CONFIG levels
of the CLI. When configuring RADIUS authentication, you create authentication-method lists specifically for these
access methods, specifying RADIUS as the primary authentication method.
Within the authentication-method list, RADIUS is specified as the primary authentication method and up to six
backup authentication methods are specified as alternates. If RADIUS authentication fails due to an error, the
device tries the backup authentication methods in the order they appear in the list.
When you configure authentication-method lists for RADIUS, you must create a separate authentication-method
list for Telnet or SSH CLI access and for CLI access to the Privileged EXEC level and CONFIG levels of the CLI.
To create an authentication-method list that specifies RADIUS as the primary authentication method for securing
Telnet access to the CLI:
ProCurveRS(config)# enable telnet authentication
ProCurveRS(config)# aaa authentication login default radius local
The commands above cause RADIUS to be the primary authentication method for securing Telnet access to the
CLI. If RADIUS authentication fails due to an error with the server, local authentication is used instead.
To create an authentication-method list that specifies RADIUS as the primary authentication method for securing
access to Privileged EXEC level and CONFIG levels of the CLI:
ProCurveRS(config)# aaa authentication enable default radius local none
The command above causes RADIUS to be the primary authentication method for securing access to Privileged
EXEC level and CONFIG levels of the CLI. If RADIUS authentication fails due to an error with the server, local
authentication is used instead. If local authentication fails, no authentication is used; the device automatically
permits access.
Syntax: [no] aaa authentication enable | login default <method1> [<method2>] [<method3>] [<method4>]
[<method5>] [<method6>] [<method7>]
The web-server | enable | login parameter specifies the type of access this authentication-method list controls.
You can configure one authentication-method list for each type of access.
June 2005 2 - 45