HP 10500 Series Configuration Manual page 37

Step
3. Set the RADIUS server status.
Specifying the source IP address for outgoing RADIUS packets
The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS
configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a
RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of
any managed NAS. If yes, the server processes the packet. If not, the server drops the packet.
Usually, the source address of outgoing RADIUS packets can be the IP address of any NAS interface that
can communicate with the RADIUS server. In some special cases, however, you must change the source
IP address. For example, if a NAT device is present between the NAS and the RADIUS server, the source
IP address of outgoing RADIUS packets must be a public IP address of the NAS.
You can specify a source IP address for outgoing RADIUS packets in RADIUS scheme view for a specific
RADIUS scheme, or in system view for all RADIUS schemes whose servers are in a VPN or the public
network. Before sending a RADIUS packet, the NAS selects a source IP address in the following order:
1. The source IP address specified for the RADIUS scheme.
2. The source IP address specified in system view for the VPN or public network, depending on where
the RADIUS server resides.
3. The IP address of the outbound interface specified by the route.
To specify a source IP address for all RADIUS schemes in a VPN or the public network:
Step
1. Enter system view.
2. Specify a source IP address
for outgoing RADIUS packets.
To specify a source IP address for a specific RADIUS scheme:
Step
1. Enter system view.
Command
•
Set the status of the primary RADIUS
authentication/authorization server:
state primary authentication { active |
block }
•
Set the status of the primary RADIUS
accounting server:
state primary accounting { active | block }
•
Set the status of a secondary RADIUS
authentication/authorization server:
state secondary authentication [ ip
ipv4-address | ipv6 ipv6-address ] { active
| block }
•
Set the status of a secondary RADIUS
accounting server:
state secondary accounting [ ip
ipv4-address | ipv6 ipv6-address ] { active
| block }
Command
system-view
radius nas-ip { ip-address | ipv6
ipv6-address } [ vpn-instance
vpn-instance-name ]
Command
system-view
27
Remarks
Optional.
By default, all servers in
the RADIUS scheme are
in active state.
Remarks
N/A
By default, the IP address of the
outbound interface is used as the
source IP address.
Remarks
N/A