HP 6600 Security Configuration Manual page 50

When a number of secondary servers are configured, the client connections of access modules that
•
have a short client connection timeout period may still be timed out during initial authentication or
accounting, even if the packet transmission attempt limit and server response timeout period are
configured with small values. In this case, the next authentication or accounting attempt can
succeed because the device has set the status of the unreachable servers to blocked so time for
finding a reachable server is shortened.
Properly set the server quiet timer. Too short a quiet timer can result in frequent authentication or
•
accounting failures because the device keeps trying to communicate with an unreachable server
that is in active state.
To set RADIUS timers:
Step
1. Enter system view.
2. Enter RADIUS scheme view.
3. Set the RADIUS server
response timeout timer.
4. Set the server quiet timer.
5. Set the real-time accounting
interval.
Configuring RADIUS accounting-on
The accounting-on feature enables the device to send an accounting-on packet to the RADIUS server after
it reboots so the server can log out users who logged in through the device before the reboot. Without this
feature, users who were online before the reboot could not re-log in after the reboot, because the RADIUS
server would consider them already online.
If the device receives no response to the accounting-on packet, it re-sends the packet to the RADIUS server
at a particular interval for a specified number of times.
The accounting-on feature requires the cooperation of the HP IMC network management system.
To configure the accounting-on feature for a RADIUS scheme:
Step
1. Enter system view.
2. Enter RADIUS scheme
view.
3. Enable accounting-on and
configure parameters.
Command
system-view
radius scheme
radius-scheme-name
timer response-timeout seconds
timer quiet minutes
timer realtime-accounting minutes
Command
system-view
radius scheme
radius-scheme-name
accounting-on enable
[ interval seconds | send
send-times ] *
36
Remarks
N/A
N/A
Optional.
The default RADIUS server
response timeout timer is 3
seconds.
Optional.
The default server quiet timer is 5
minutes.
Optional.
The default real-time accounting
interval is 12 minutes.
Remarks
N/A
N/A
Disabled by default.
The default interval is 3 seconds and the
default number of send-times is 50.