R3721-F3210-F3171-HP High-End Firewalls Access Control Configuration Guide-6PW101

187
Setting the username format and traffic statistics units
A username is usually in the format of userid@isp-name, where isp-name represents the name of the ISP
domain the user belongs to and is used by the firewall to determine which users belong to which ISP
domains. However, some earlier RADIUS servers cannot recognize usernames that contain an ISP
domain name. In this case, the firewall must remove the domain name of each username before sending
the username. You can set the username format on the firewall for this purpose.
The firewall periodically sends accounting updates to RADIUS accounting servers to report the traffic
statistics of online users. For normal and accurate traffic statistics, make sure that the unit for data flows
and that for packets on the firewall are consistent with those on the RADIUS server.
Follow these guidelines when you set the username format and the traffic statistics units for a RADIUS
scheme:
• If a RADIUS scheme defines that the username is sent without the ISP domain name, do not apply
the RADIUS scheme to more than one ISP domain. Otherwise, users using the same username but
in different ISP domains are considered the same user.
• For level switching authentication, the user-name-format keep-original and user-name-format
without-domain commands produce the same results. They make sure usernames sent to the
RADIUS server carry no ISP domain name.
To set the username format and the traffic statistics units for a RADIUS scheme:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enter RADIUS scheme view.
radius scheme
radius-scheme-name
N/A
3. Set the format for usernames
sent to the RADIUS servers.
user-name-format { keep-original
| with-domain | without-domain }
Optional.
By default, the ISP domain name is
included in a username.
4. Specify the unit for data flows
or packets sent to the RADIUS
servers.
data-flow-format { data { byte |
giga-byte | kilo-byte |
mega-byte } | packet
{ giga-packet | kilo-packet |
mega-packet | one-packet } }*
Optional.
The default unit is byte for data
flows and one-packet for data
packets by default.
Specifying the source IP address for outgoing RADIUS packets
The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS
configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a
RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of
any managed NAS. If yes, the server processes the packet. If not, the server drops the packet.
Usually, the source address of outgoing RADIUS packets can be the IP address of the NAS's any
interface that can communicate with the RADIUS server. In some special scenarios, however, you must
change the source IP address. For example, if a Network Address Translation (NAT) device is present
between the NAS and the RADIUS server, the source IP address of outgoing RADIUS packets must be a
public IP address of the NAS. If the NAS is configured with the Virtual Router Redundancy Protocol (VRRP)
for stateful failover, the source IP address of outgoing RADIUS packets can be the virtual IP address of the
VRRP group to which the uplink belongs.