F3726, F3211, F3174, R5135, R3816-HP Firewalls and UTM Devices Access Control Configuration Guide-6PW100

213
By default, the device sets the status of all RADIUS servers to active. In some cases, however, you may
need to change the status of a server. For example, if a server fails, you can change the status of the
server to blocked to avoid communication attempts to the server.
To set the status of RADIUS servers in a RADIUS scheme:
Ste
p
Command Remarks
1. Enter system
view.
system-view N/A
2. Enter RADIUS
scheme view.
radius scheme radius-scheme-name N/A
3. Set the RADIUS
server status.
• Set the status of the primary RADIUS
authentication/authorization server:
state primary authentication { active | block }
• Set the status of the primary RADIUS accounting server:
state primary accounting { active | block }
• Set the status of a secondary RADIUS
authentication/authorization server:
state secondary authentication [ ip ipv4-address | ipv6
ipv6-address ] { active | block }
• Set the status of a secondary RADIUS accounting server:
state secondary accounting [ ip ipv4-address | ipv6
ipv6-address ] { active | block }
Optional.
By default, all servers
in the RADIUS scheme
are in active state.
Support for the ipv6
ipv6-address option
depends on the device
model. For more
information, see
Access Control
Command Reference.
The server status set by the state command cannot be saved to the configuration file. After the device
restarts, the status of each server is restored to active.
To display the states of the servers, use the display radius scheme command.
438BSpecifying the source IP address for outgoing RADIUS packets
The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS
configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a
RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of
any managed NAS. If yes, the server processes the packet. If not, the server drops the packet.
The source address of outgoing RADIUS packets is typically the IP address of an egress interface on the
NAS to communicate with the RADIUS server. In some cases, however, you must change the source IP
address. For example, if the NAS is configured with VRRP for stateful failover, the source IP address of
outgoing RADIUS packets can be the virtual IP address of the uplink VRRP group.
You can specify a source IP address for outgoing RADIUS packets in RADIUS scheme view for a specific
RADIUS scheme, or in system view for all RADIUS schemes whose servers are in a VPN or the public
network. Before sending a RADIUS packet, the NAS selects a source IP address in the following order:
• The source IP address specified for the RADIUS scheme.
• The source IP address specified in system view for the VPN or public network, depending on where
the RADIUS server resides.
• The IP address of the outbound interface specified by the route.
To specify a source IP address for all RADIUS schemes in a VPN or the public network:
Ste
p
Command Remarks
1. Enter system view. system-view N/A