Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide Authentication Servers | 249
In the CLI
aaa profile <profile>
radius-accounting <group>
TACACS+ Accounting
TACACS+ accounting allows commands issued on the controller to be reported to TACACS+ servers. You can
specify the types of commands that are reported (action, configuration, or show commands) or have all
commands reported.
You can configure TACACS+ accounting only with the CLI:
aaa tacacs-accounting server-group <group> command {action|all|configuration|show} mode
{enable|disable}
Configuring Authentication Timers
Table 51 describes the timers you can configure that apply to all clients and servers. These timers can be left at
their default values for most implementations.
Setting an Authentication Timer
To set an authentication timer, complete one of the following procedures:
Table 51 Authentication Timers
Timer Description
User Idle Timeout Maximum period, in minutes or seconds, after which a client is considered idle if
there is no user traffic from the client.
The timeout period is reset if there is a user traffic. After this timeout period has
elapsed, the controller sends probe packets to the client; if the client responds to
the probe, it is considered active and the User Idle Timeout is reset (an active client
that is not initiating new sessions is not removed). If the client does not respond to
the probe, it is removed from the system. To prevent clients from timing out, set the
value in the field to 0. After entering the value, select either min for minutes or sec
for seconds from the drop-down list.
Range: 0–255
Default: 5 minutes
Authentication Server Dead
Time
Maximum period, in minutes, that the controller considers an unresponsive
authentication server to be “out of service”.
This timer is only applicable if there are two or more authentication servers
configured on the controller. If there is only one authentication server configured,
the server is never considered out of service and all requests are sent to the server.
If one or more backup servers are configured and a server is unresponsive, it is
marked as out of service for the dead time; subsequent requests are sent to the next
server on the priority list for the duration of the dead time. If the server is responsive
after the dead time has elapsed, it can take over servicing requests from a lower-
priority server; if the server continues to be unresponsive, it is marked as down for
the dead time.
Range: 0–50
Default: 10 minutes
Logon User Lifetime Maximum time, in minutes, unauthenticated clients are allowed to remain logged on.
Range: 0–255
Default: 5 minutes