Troubleshooting Hwtacacs Configuration - H3C S5600 Series Operation Manual

Operation Manual – AAA
H3C S5600 Series Ethernet Switches
The user is not configured in the database of the RADIUS server — Check the
database of the RADIUS server, make sure that the configuration information
about the user exists.
The user input an incorrect password — Be sure to input the correct password.
The switch and the RADIUS server have different shared keys — Compare the
shared keys at the two ends, make sure they are identical.
The switch cannot communicate with the RADIUS server (you can determine by
pinging the RADIUS server from the switch) — Take measures to make the switch
communicate with the RADIUS server normally.
Symptom 2: RADIUS packets cannot be sent to the RADIUS server.
Possible reasons and solutions:
The communication links (physical/link layer) between the switch and the RADIUS
server is disconnected/blocked — Take measures to make the links
connected/unblocked.
None or incorrect RADIUS server IP address is set on the switch — Be sure to set
a correct RADIUS server IP address.
One or all AAA UDP port settings are incorrect — Be sure to set the same UDP
port numbers as those on the RADIUS server.
Symptom 3: The user passes the authentication and gets authorized, but the
accounting information cannot be transmitted to the RADIUS server.
Possible reasons and solutions:
The accounting port number is not properly set — Be sure to set a correct port
number for RADIUS accounting.
The switch requests that both the authentication/authorization server and the
accounting server use the same device (with the same IP address), but in fact they
are not resident on the same device — Be sure to configure the RADIUS servers
on the switch according to the actual situation.

2.6.2 Troubleshooting HWTACACS Configuration

See the previous section if you encounter an HWTACACS fault.
2-38
Chapter 2 AAA Configuration