HP 5120 EI Switch Series Configuration Manual page 33

NOTE:

The IP addresses of the primary and secondary accounting servers must be different from each other. Otherwise,
the configuration fails.

All servers for authentication/authorization and accountings, primary or secondary, must use IP addresses of the
same IP version.

If you delete an accounting server serving users, the device can no longer send real-time accounting requests
and stop-accounting requests for the users to that server, or buffer the stop-accounting requests.

You can specify a RADIUS accounting server as the primary accounting server for one scheme and as the
secondary accounting server for another scheme at the same time.

RADIUS does not support accounting for FTP users.
Setting the shared keys for RADIUS packets
The RADIUS client and RADIUS server use the MD5 algorithm to encrypt packets exchanged between
them and use shared keys to verify the packets. They must use the same shared key for the same type of
packets.
A shared key configured in this task is for all servers of the same type (accounting or authentication) in
the scheme, and has a lower priority than a shared key configured individually for a RADIUS server.
Follow these steps to set the shared keys for RADIUS packets:
To do...
Enter system view
Enter RADIUS scheme view
Set the shared key for RADIUS
authentication/authorization or
accounting packets
NOTE:
A shared key configured on the device must be the same as that configured on the RADIUS server.
Setting the maximum number of RADIUS request transmission attempts
Because RADIUS uses UDP packets to transfer data, the communication process is not reliable. RADIUS
uses a retransmission mechanism to improve reliability. If a NAS sends a RADIUS request to a RADIUS
server but receives no response before the response timeout timer expires, it retransmits the request. If the
number of transmission attempts exceeds the specified limit but it still receives no response, it tries to
communicate with other RADIUS servers in the active state. If no other servers are in the active state at the
time, it considers the authentication a failure. For more information about RADIUS server states, see
―Setting the status of RADIUS
Follow these steps to set the maximum number of RADIUS request transmission attempts:
To do...
Enter system view
Enter RADIUS scheme view
Set the maximum number of
RADIUS request transmission
attempts
Use the command...
system-view
radius scheme radius-scheme-
name
key { accounting | authentication
} string
servers.―
Use the command...
system-view
radius scheme radius-scheme-
name
retry retry-times
23
Remarks
—
—
Required
No shared key by default
Remarks
—
—
Optional
3 by default