Configuring Shared Keys For Hwtacacs Packets - H3C S7500 Series Operation Manual

Operation Manual – AAA & RADIUS & HWTACACS & EAD
H3C S7500 Series Ethernet Switches
Caution:
The primary and secondary accounting servers cannot use the same IP address.
Otherwise, the system will prompt unsuccessful configuration.
You can remove a server only when it is not being used by any active TCP
connection for sending accounting packets.
Currently, HWTACACS does not support the accounting of FTP users.

1.5.5 Configuring Shared Keys for HWTACACS Packets

When using a TACACS server as an AAA server, you can set a key to improve the
communication security between the router and the TACACS server.
The TACACS client (device system) and server adopt MD5 algorithm to encrypt the
exchanged HWTACACS packets. The two parties verify the validity of the exchanged
packets by using the shared keys that have been set on them, and can accept and
respond to the packets sent from each other only if both of them have the same shared
keys. Therefore, make sure the shared key set on the device and that on TACACS
server are the same.
Table 1-27 Configure shared keys for HWTACACS packets
Enter system view
Create a HWTACACS
scheme and enter its view
Set a shared key for the
HWTACACS
accounting/authentication
/authorization packets
To do...
system-view
hwtacacs scheme
hwtacacs-scheme-name
key { accounting |
authorization |
authentication } string
Chapter 1 AAA & RADIUS & HWTACACS
Use the command...
1-36
Configuration
Remarks
—
Required
By default, no
HWTACACS scheme
exists.
Required
By default, the TACACS
server does not have a
key.