H3C S9500 Series Operation Manual page 746

Operation Manual – Security
H3C S9500 Series Routing Switches
# Set IP address of the primary authentication/accounting RADIUS servers.
[H3C-radius-radius1] primary authentication 10.11.1.1
[H3C-radius-radius1] primary accounting 10.11.1.2
# Set the IP address of the secondary authentication/accounting RADIUS servers.
[H3C-radius-radius1] secondary authentication 10.11.1.2
[H3C-radius-radius1] secondary accounting 10.11.1.1
# Set the encryption key when the system exchanges packets with the authentication
RADIUS server.
[H3C-radius-radius1] key authentication name
# Set the encryption key when the system exchanges packets with the accounting
RADIUS server.
[H3C-radius-radius1] key accounting money
# Set the timeouts and times for the system to retransmit packets to the RADIUS
server.
[H3C-radius-radius1] timer 5
[H3C-radius-radius1] retry 5
# Set the interval for the system to transmit real-time accounting packets to the
RADIUS server.
[H3C-radius-radius1] timer realtime-accounting 15
# Configure the system to transmit the user name to the RADIUS server after removing
the domain name.
[H3C-radius-radius1] user-name-format without-domain
[H3C-radius-radius1] quit
# Create the user domain H3C.net and enters its configuration mode.
[H3C] domain H3C.net
# Specify radius1 as the RADIUS scheme for the users in the domain H3C.net.
[H3C-isp-H3C.net] radius-scheme radius1
# Set a limit of 30 users to the domain H3C.net.
[H3C-isp-H3C.net] access-limit enable 30
# Enable idle cut function for the user and set the idle cut parameter in the domain
H3C.net.
[H3C-isp-H3C.net] idle-cut enable 20 2000
# Add a local supplicant and sets its parameter.
[H3C] local-user localuser
[H3C-luser-localuser] service-type lan-access
[H3C-luser-localuser] password simple localpass
1-14
Chapter 1 802.1x Configuration