3Com 7757 Configuration Manual page 534

534 C 49: AAA & RADIUS & HWTACACS C
HAPTER
Configuring Shared Keys
for RADIUS Packets
Table 421 Configure HWTACACS accounting servers
Operation
Create a HWTACACS
scheme and enter its view
Set the IP address and port
number of the primary
TACACS accounting server
Set the IP address and port
number of the secondary
TACACS accounting server
Enable the stop-accounting
packets retransmission
function and set the
maximum number of
attempts
c
CAUTION:
The primary and secondary accounting servers cannot use the same IP address.
■
Otherwise, the system will prompt unsuccessful configuration.
You can remove a server only when it is not used by any active TCP connection
■
for sending accounting packets.
When using a TACACS server as an AAA server, you can set a key to improve the
communication security between the router and the TACACS server.
The TACACS client and server adopt MD5 algorithm to encrypt the exchanged
HWTACACS packets. The two parties verify the validity of the exchanged packets
by using the shared keys that have been set on them, and can accept and respond
to the packets sent from each other only if both of them have the same shared
keys.
Table 422 Configure shared keys for TACACS packets
Operation
Enter system view
Create a HWTACACS
scheme and enter its
view
Set a shared key for
the HWTACACS
accounting/authentica
tion/authorization
packets
ONFIGURATION
Command
hwtacacs scheme
hwtacacs-scheme-name
primary accounting ip-address
[ port ]
secondary accounting
ip-address [ port ]
retry stop-accounting
retry-times
Command
system-view
hwtacacs scheme
hwtacacs-scheme-name
key { accounting |
authorization |
authentication } string
Description
Required
By default, no HWTACACS
scheme exists.
Required
By default, the IP address of
the primary accounting
server is 0.0.0.0, and the
port number is 0.
Required
By default, the IP address of
the secondary accounting
server is 0.0.0.0, and the
port number is 0.
Optional
By default, the
stop-accounting packets
retransmission function is
enabled and the system can
transmit a stop-accounting
request for 100 times.
Description
-
Required
By default, no HWTACACS scheme
exists.
Required
By default, the TACACS server does
not have a key.