R3303-HP HSR6800 Routers Security Command Reference

66
Parameters
ipv4-address: Specifies the IPv4 address of the primary RADIUS accounting server.
ipv6 ipv6-address: Specifies the IPv6 address of the primary RADIUS accounting server, which must be
a valid global unicast address.
port-number: Specifies the service port number of the primary RADIUS accounting server, which is a UDP
port number ranging from 1 to 65535 and defaults to 1813.
key [ cipher | simple ] key: Specifies the shared key for secure communication with the primary RADIUS
accounting server. In FIPS mode, the shared key must be a string of at least 8 characters that contain
numbers, uppercase letters, lowercase letters, and special characters, and is encrypted and decrypted
by using 3DES.
• cipher key: Specifies a ciphertext shared key, which is a case-sensitive ciphertext string of 1 to 117
characters.
• simple key: Specifies a plaintext shared key, which is a case-sensitive string of 1 to 64 characters.
• If neither cipher nor simple is specified, you set a plaintext shared key string.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN to which the primary RADIUS accounting
server belongs. The vpn-instance-name argument is a case-sensitive string of 1 to 31 characters. If the
server is on the public network, do not specify this option.
Usage guidelines
Make sure the port number and shared key settings of the primary RADIUS accounting server are the
same as those configured on the server.
The shared key configured by this command takes precedence over that configured by using the key
accounting [ cipher | simple ] key command. For secrecy, all shared keys, including keys configured in
plain text, are saved in cipher text.
The IP addresses of the accounting servers and those of the authentication/authorization servers must be
of the same IP version.
The IP addresses of the primary and secondary accounting servers must be different from each other.
Otherwise, the configuration fails.
If the specified server resides on an MPLS L3VPN, specify the VPN by using the vpn-instance
vpn-instance-name option. The VPN specified by this command takes precedence over the VPN
specified for the RADIUS scheme.
If you change the primary accounting server when the device has already sent a start-accounting request
to the server, the communication with the primary server times out, and the device looks for a server in
active state from the new primary server on.
If you remove an accounting server being used by users, the device can no longer send real-time
accounting requests or stop-accounting requests for the users, and it does not buffer the stop-accounting
requests.
Examples
# For RADIUS scheme radius1, set the IP address of the primary accounting server to 10.110.1.2, the UDP
port to 1813, and the shared key to hello in plain text.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] primary accounting 10.110.1.2 1813 key simple hello