Local-Server Nas - H3C s3600 series Command Manual

Use the undo local-server command to disable the UDP ports for local RADIUS services.
By default, the UDP ports for local RADIUS services are enabled.
In addition to functioning as a RADIUS client to provide remote RADIUS authentication, authorization,
and accounting services, the switch can act as a local RADIUS server to provide simple RADIUS server
functions locally. For the switch to act as a local server, you need to use this command to enable the
service ports. The UDP port for local RADIUS authentication/authorization service is 1645, and that for
local RADIUS accounting service is 1646.
Related commands: radius scheme, state, local-server nas-ip.
Examples
# Enable UDP ports for local RADIUS services.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] local-server enable
local-server nas-ip
Syntax
local-server nas-ip ip-address key password
undo local-server nas-ip ip-address
View
System view
Parameters
nas-ip ip-address: Specifies the IP address of a network access server (NAS) that can use the local
RADIUS services. Here, ip-address is in dotted decimal notation.
key password: Sets the shared key between the local RADIUS server and the NAS. Here, password is
a string of up to 16 characters.
Description
Use the local-server nas-ip command to set the related parameters of the local RADIUS server.
Use the undo local-server nas-ip command to cancel a specified NAS setting for the local RADIUS
server.
By default, the local RADIUS server is enabled and it allows the access of NAS 127.0.0.1. That is, the
local device serves as both a RADIUS server and a network access server, and all authentications are
performed locally. The default share key is null.
Note that:
The message encryption key set by the local-server nas-ip ip-address key password command
must be identical with the authentication/authorization message encryption key set by the key
authentication command in the RADIUS scheme view of the RADIUS scheme on the specified
NAS that uses this switch as its authentication server.
The switch supports the IP addresses and shared keys of at most 16 network access servers
(including the local device); that is, when the switch serves as a RADIUS server, it can provide
authentication service to at most 16 NASs simultaneously.
1-37