R3721-F3210-F3171-HP High-End Firewalls Access Control Command Reference-6PW101

137
key [ cipher | simple ] key: Specifies the shared key (case-sensitive) for exchanging accounting packets
with the secondary RADIUS accounting server. Follow these guidelines:
• This shared key must be the same as that configured on the RADIUS server.
• With the cipher keyword specified, the key must be a ciphertext string of 12, 24, 32, 44, 64, 76, 88,
or 96 characters, for example, _(TT8F]Y\5SQ=^Q`MAF4<1!!, and the key is displayed in cipher
text.
• With the simple keyword specified, the key must be a plaintext string of 1 to 64 characters, for
example aabbcc, and the key is displayed in plain text. The FIPS mode does not support the simple
keyword.
• With neither the cipher keyword nor the cipher keyword specified, the key must be a plaintext string
of 1 to 64 characters, and the key is displayed in cipher text.
• In FIPS mode, the key must be a ciphertext string of at least 8 characters that must contain uppercase
letters, lowercase letters, digits, and special characters, and is encrypted and decrypted with the
3DES algorithm.
vpn-instance vpn-instance-name: Specifies the VPN to which the secondary RADIUS accounting server
belongs, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is on the
public network, do not specify this option.
Description
Use secondary accounting to specify secondary RADIUS accounting servers for a RADIUS scheme.
Use undo secondary accounting to remove a secondary RADIUS accounting server.
By default, no secondary RADIUS accounting server is specified.
You can configure up to 16 secondary RADIUS accounting servers for a RADIUS scheme by executing
this command repeatedly. After the configuration, if the primary server fails, the firewall looks for a
secondary server in active state (a secondary RADIUS accounting server configured earlier has a higher
priority) and tries to communicate with it.
The IP addresses of the accounting servers and those of the authentication/authorization servers must be
of the same IP version.
The IP addresses of the primary and secondary accounting servers must be different from each other.
Otherwise, the configuration fails.
If the specified server resides on a VPN, specify the VPN by using the vpn-instance vpn-instance-name
option.
If you remove a secondary accounting server when the firewall has already sent a start-accounting
request to the server, the communication with the secondary server times out, and the firewall looks for
a server in active state from the primary server on.
If you remove an accounting server being used by online users, the firewall no longer sends real-time
accounting requests and stop-accounting requests for the users, and does not buffer the stop-accounting
requests.
NOTE:
• The shared key configured by this command takes precedence over that configured by using the key
accounting [ cipher | simple ]
key command.
• The VPN specified by this command takes precedence over the VPN specified for the RADIUS scheme.
Related commands: key, state, and vpn-instance (RADIUS scheme view).