F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices Access Control Configuration Guide-6PW100

210
Ste
p
Command Remarks
2. Enter RADIUS scheme
view.
radius scheme
radius-scheme-name
N/A
3. Specify a shared key
for secure RADIUS
authentication/authori
zation or accounting
communication.
key { accounting |
authentication } [ cipher |
simple ] key
By default, no shared key is specified.
The shared key configured on the device must be
the same as that configured on the RADIUS server.
In FIPS mode, you cannot set a plaintext key, and
the key must contain at least 8 characters
comprising uppercase and lowercase letters,
digits, and special characters.
433BSpecifying a VPN for the RADIUS scheme
You can specify a VPN for all the AAA servers in a RADIUS scheme. However, the VPN has a lower
priority than those configured for individual RADIUS servers.
To specify a VPN for a RADIUS scheme:
Ste
p
Command
1. Enter system view. system-view
2. Enter RADIUS scheme view.
radius scheme radius-scheme-name
3. Specify a VPN for the RADIUS scheme. vpn-instance vpn-instance-name
434BSetting the username format and traffic statistics units
A username is usually in the format userid@isp-name, where isp-name represents the user's ISP domain
name. By default, the ISP domain name is included in a username; however, some earlier RADIUS
servers do not recognize usernames that contain the ISP domain names. In this case, you can configure
the device to remove the domain name from each username to be sent.
The device periodically sends accounting updates to RADIUS accounting servers to report the traffic
statistics of online users. For normal and accurate traffic statistics, make sure that the unit for data flows
and that for packets on the device are consistent with those on the RADIUS server.
To set the username format and the traffic statistics units for a RADIUS scheme:
Ste
p
Command Remarks
1. Enter system view. system-view N/A
2. Enter RADIUS scheme
view.
radius scheme radius-scheme-name N/A
3. Set the format for
usernames sent to the
RADIUS servers.
user-name-format { keep-original |
with-domain | without-domain }
Optional.
By default, the ISP domain name is
included in a username.
4. Specify the unit for data
flows or packets sent to the
RADIUS servers.
data-flow-format { data { byte |
giga-byte | kilo-byte | mega-byte }
| packet { giga-packet | kilo-packet
| mega-packet | one-packet } }*
Optional.
The default unit is byte for data flows
and one-packet for data packets.