HP 5500 HI Series Configuration Manual page 52

Specifying a source IP address for outgoing HWTACACS packets
The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS
configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon
receiving an HWTACACS packet, an HWTACACS server checks whether the source IP address of the
packet is the IP address of any managed NAS. If yes, the server processes the packet. If not, the server
drops the packet.
Usually, the source address of outgoing HWTACACS packets can be the IP address of the NAS's any
interface that can communicate with the HWTACACS server. In some special scenarios, however, you
must change the source IP address. If the NAS is configured with the Virtual Router Redundancy Protocol
(VRRP) for stateful failover, the source IP address of HWTACACS packets can be the virtual IP address of
the VRRP group to which the uplink belongs.
You can specify the source IP address for outgoing HWTACACS packets in HWTACACS scheme view for
a specific HWTACACS scheme, or in system view for all HWTACACS schemes whose servers are in the
same VPN.
Before sending an HWTACACS packet, a NAS selects a source IP address in the following order:
Source IP address specified for the HWTACACS scheme.
•
Source IP address specified in system view for the VPN.
•
IP address of the outbound interface specified by the route.
•
To specify a source IP address for all HWTACACS schemes:
Step
1. Enter system view.
2. Specify a source IP address
for outgoing HWTACACS
packets.
To specify a source IP address for a specific HWTACACS scheme:
Step
1. Enter system view.
2. Enter HWTACACS scheme
view.
3. Specify a source IP address
for outgoing HWTACACS
packets.
Setting timers for controlling communication with HWTACACS servers
The switch uses the following timers to control the communication with an HWTACACS server:
Server response timeout timer (response-timeout)—Defines the HWTACACS request
•
retransmission interval. After sending an HWTACACS request (authentication, authorization, or
accounting request), the switch starts this timer. If the switch receives no response from the server
before this timer expires, it resends the request.
Server quiet timer (quiet)—Defines the duration to keep an unreachable server in blocked state. If
•
a server is not reachable, the switch changes the server's status to blocked, starts this timer for the
Command
system-view
hwtacacs nas-ip ip-address
[ vpn-instance vpn-instance-name ]
Command
system-view
hwtacacs scheme
hwtacacs-scheme-name
nas-ip ip-address
39
Remarks
N/A
By default, the IP address of the
outbound interface is used as the
source IP address.
Remarks
N/A
N/A
By default, the IP address of the
outbound interface is used as the
source IP address.