Configuring A Radius User; Specifying A Radius Client - H3C S5120-HI Security Configuration Manual

Configuring a RADIUS user

This task is to create a RADIUS user and configure a set of attributes for the user on a switch that serves
as the RADIUS server. The user attributes include the password, authorization attribute, expiration time,
and user description. After completing this task, the specified RADIUS user can use the username and
password for RADIUS authentication on the switch.
You can use the authorization-attribute command to specify an authorization ACL and authorized VLAN,
which is assigned by the RADIUS server to the RADIUS client (the NAS) after the RADIUS user passes
authentication. The NAS then uses the assigned ACL and VLAN to control user access. If the assigned
ACL does not exist on the NAS, ACL assignment fails and the NAS forcibly logs out the RADIUS user. If
the assigned VLAN does not exist on the NAS, the NAS creates the VLAN and adds the RADIUS user or
the access port to the VLAN.
To configure a RADIUS user:
Step
1. Enter system view.
2. Create a RADIUS user and
enter RADIUS server user
view.
3. Configure a password for the
RADIUS user.
4. Configure the authorization
attribute for the RADIUS user.
5. Set the expiration time for the
RADIUS user.
6. Configure a description for
the RADIUS user.

Specifying a RADIUS client

This task is to specify the IP address of a client to be managed by the RADIUS server and configure the
shared key. The RADIUS server processes only the RADIUS packets sent from the specified clients.
To specify a RADIUS client
Step
1. Enter system view.
2. Specify a RADIUS client.
Command
system-view
radius-server user user-name
password [ cipher | simple ]
password
authorization-attribute { acl
acl-number | vlan vlan-id } *
expiration-date time
description text
Command
system-view
radius-server client-ip ip-address [ key
[ cipher | simple ] string ]
46
Remarks
N/A
No RADIUS user exists by default.
Optional.
By default, no password is
specified.
Optional.
Not configured by default.
Optional.
By default, no expiration time is
set, and the system does not check
users' expiration time.
Optional.
Not configured by default.
Remarks
N/A
No RADIUS client is
specified by default.