HP A5830 Series Configuration Manual page 42

Setting the username format and traffic statistics units
A username is usually in the format of userid@isp-name, where isp-name represents the name of the ISP
domain to which the user belongs. The switch uses it to determine which users belong to which ISP
domains. However, some HWTACACS servers cannot recognize usernames that contain an ISP domain
name. In this case, the switch must remove the domain name of each username before sending the
username. You can set the username format on the switch for this purpose.
The switch periodically sends accounting updates to HWTACACS accounting servers to report the traffic
statistics of online users. For normal and accurate traffic statistics, make sure that the unit for data flows
and that for packets on the switch are consistent with those configured on the HWTACACS servers.
To set the username format and the traffic statistics units for an HWTACACS scheme:
To do...
1. Enter system view.
2. Enter HWTACACS scheme
view.
3. Set the format for usernames
sent to the HWTACACS
servers.
4. Specify the unit for data flows
or packets sent to the
HWTACACS servers.
If an HWTACACS server does not support a username that carries the domain name, configure the
switch to remove the domain name before sending the username to the server.
For level switching authentication, the user-name-format keep-original and user-name-format without-
domain commands produce the same results: they make sure that usernames sent to the HWTACACS
server carry no ISP domain name.
Specifying a source IP address for outgoing HWTACACS packets
The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS
configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon
receiving an HWTACACS packet, an HWTACACS server checks whether the source IP address of the
packet is the IP address of any managed NAS. If it is, the server processes the packet. If it is not, the
server drops the packet.
Usually, the source address of outgoing HWTACACS packets can be the IP address of any NAS
interface that can communicate with the HWTACACS server. In some special scenarios, however, you
must change the source IP address. For example, if a NAT device is present between the NAS and the
HWTACACS server, the source IP address of outgoing HWTACACS packets must be a public IP address
of the NAS.
You can specify the source IP address for outgoing HWTACACS packets in HWTACACS scheme view
for a specific HWTACACS scheme or in system view for all HWTACACS schemes.
Before sending an HWTACACS packet, a NAS selects a source IP address in this order:
The source IP address specified for the HWTACACS scheme
1.
The source IP address specified in system view
2.
Use the command...
system-view
hwtacacs scheme hwtacacs-scheme-
name
user-name-format { keep-original |
with-domain | without-domain }
data-flow-format { data { byte |
giga-byte | kilo-byte | mega-byte }
| packet { giga-packet | kilo-
packet | mega-packet | one-packet
} }*
34
Remarks
—
—
Optional.
By default, the ISP domain name
is included in a username.
Optional.
It is set to byte for data flows
and one-packet for data packets
by default.