HP 5120 SI Series Security Configuration Manual page 47

NOTE:
If an HWTACACS server does not support a username with the domain name, configure the device to
•
remove the domain name before sending the username to the server.
For level switching authentication, the user-name-format keep-original and user-name-format
•
without-domain commands produce the same results: they ensure that usernames sent to the
HWTACACS server carry no ISP domain name.
Specifying a source IP address for outgoing HWTACACS packets
The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS
configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon
receiving an HWTACACS packet, an HWTACACS server checks whether the source IP address of the
packet is the IP address of any managed NAS. If yes, the server processes the packet. If not, the server
drops the packet.
Usually, the source address of outgoing HWTACACS packets can be the IP address of the NAS's any
interface that can communicate with the HWTACACS server.
You can specify the source IP address for outgoing HWTACACS packets in HWTACACS scheme view for
a specific HWTACACS scheme, or in system view for all HWTACACS schemes.
Before sending an HWTACACS packet, a NAS selects a source IP address in this order:
1. The source IP address specified for the HWTACACS scheme.
2. The source IP address specified in system view.
3. The IP address of the outbound interface specified by the route.
Follow these steps to specify a source IP address for all HWTACACS schemes:
To do...
Enter system view
Specify a source IP address for
outgoing HWTACACS packets
Follow these steps to specify a source IP address for a specific HWTACACS scheme:
To do...
Enter system view
Enter HWTACACS scheme
view
Specify a source IP address for
outgoing HWTACACS packets
Setting timers for controlling communication with HWTACACS servers
Follow these steps to set timers regarding HWTACACS servers:
To do...
Enter system view
Use the command...
system-view
hwtacacs nas-ip ip-address
Use the command...
system-view
hwtacacs scheme
hwtacacs-scheme-name
nas-ip ip-address
Use the command...
system-view
35
Remarks
—
Required
By default, the IP address of the outbound
interface is used as the source IP address.
Remarks
—
—
Required
By default, the IP address of the outbound
interface is used as the source IP address.
Remarks
—