Huawei Quidway S5600 Series Operation Manual page 567

Operation Manual – AAA & RADIUS & HWTACACS & EAD
Quidway S5600 Series Ethernet Switches-Release 1510
Operation
Set the IP address and
port number
secondary
accounting server
Enable
stop-accounting packets
retransmission
and set the maximum
number of attempts
Caution:
The primary and secondary accounting servers cannot use the same IP address.
Otherwise, the system will prompt unsuccessful configuration.
You can remove a server only when it is not used by any active TCP connection for
sending accounting packets.
1.5.5 Configuring Shared Keys for RADIUS Packets
When using a TACACS server as an AAA server, you can set a key to improve the
communication security between the router and the TACACS server.
The TACACS client and server adopt MD5 algorithm to encrypt the exchanged
HWTACACS packets. The two parties verify the validity of the exchanged packets by
using the shared keys that have been set on them, and can accept and respond to the
packets sent from each other only if both of them have the same shared keys.
Table 1-28 Configure shared keys for TACACS packets
Operation
Enter system view
Create
HWTACACS
scheme and enter
its view
Command
of the secondary
TACACS ip-address [ port ]
the
retry
function
retry-times
Command
system-view
a
hwtacacs
hwtacacs-scheme-name
Huawei Technologies Proprietary
1-37
Chapter 1 AAA & RADIUS & HWTACACS
Required
By
accounting
address
secondary accounting
server is 0.0.0.0, and
the port number is 0.
Optional
By
stop-accounting
stop-accounting
packets retransmission
function is enabled and
the system can transmit
a
request for 100 times.
Description
—
Required
scheme
By default,
scheme exists.
Configuration
Description
default, the IP
of the
default, the
stop-accounting
no HWTACACS