HP 6125G Configuration Manual page 33

Specifying the shared keys for secure RADIUS communication
The RADIUS client and RADIUS server use the MD5 algorithm to authenticate packets exchanged
between them and use shared keys for packet authentication and user passwords encryption. They must
use the same key for the same type of communication.
A shared key configured in this task is for all servers of the same type (accounting or authentication) in
the scheme, and has a lower priority than a shared key configured individually for a RADIUS server.
To specify a shared key for secure RADIUS communication:
Step
1. Enter system view.
2. Enter RADIUS scheme view.
3. Specify a shared key for secure RADIUS
authentication/authorization or
accounting communication.
NOTE:
A shared key configured on the switch must be the same as that configured on the RADIUS server.
Specifying the VPN to which the servers belong
After you specify a VPN for a RADIUS scheme, all the authentication/authorization/accounting servers
specified for the scheme belong to the VPN. However, if you also specify a VPN when specifying a server
for the scheme, the server belongs to the specific VPN.
To specify a VPN for a RADIUS scheme:
Step
1. Enter system view.
2. Enter RADIUS scheme view.
3. Specify a VPN for the RADIUS scheme.
Setting the username format and traffic statistics units
A username is usually in the format of userid@isp-name, where isp-name represents the name of the ISP
domain the user belongs to and is used by the switch to determine which users belong to which ISP
domains. However, some earlier RADIUS servers cannot recognize usernames that contain an ISP
domain name. In this case, the switch must remove the domain name of each username before sending
the username. You can set the username format on the switch for this purpose.
The switch periodically sends accounting updates to RADIUS accounting servers to report the traffic
statistics of online users. For normal and accurate traffic statistics, make sure the unit for data flows and
that for packets on the switch are consistent with those on the RADIUS server.
Follow these guidelines when you set the username format and the traffic statistics units for a RADIUS
scheme:
If a RADIUS scheme defines that the username is sent without the ISP domain name, do not apply
•
the RADIUS scheme to more than one ISP domain. Otherwise, users using the same username but
in different ISP domains are considered the same user.
Command
system-view
radius scheme
radius-scheme-name
key { accounting |
authentication [ cipher |
simple ] } key
Command
system-view
radius scheme radius-scheme-name
vpn-instance vpn-instance-name
23
Remarks
N/A
N/A
No shared key is specified by
default.