R3721-F3210-F3171-HP High-End Firewalls Access Control Configuration Guide-6PW101

189
because the client connection timeout period for voice users is 10 seconds and that for Telnet users
is 30 seconds.
• When you configure the maximum number of RADIUS packet transmission attempts and the
RADIUS server response timeout period, take the number of secondary servers into account. If the
retransmission process takes too much time, the client connection in the access module may be
timed out while the firewall is trying to find an available server.
• When a number of secondary servers are configured, the client connections of access modules that
have a short client connection timeout period may still be timed out during initial authentication or
accounting, even if the packet transmission attempt limit and server response timeout period are
configured with small values. In this case, the next authentication or accounting attempt may
succeed because the firewall has set the state of the unreachable servers to blocked and the time for
finding a reachable server is shortened.
• Set the server quiet timer properly. Too short a quiet timer may result in frequent authentication or
accounting failures because the firewall has to repeatedly attempt to communicate with an
unreachable server that is in active state.
• For more information about the maximum number of RADIUS packet transmission attempts, see
"Setting the maximum number of RADIUS request transmission attempts."
T
o set timers for controlling communication with RADIUS servers:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter RADIUS scheme view.
radius scheme
radius-scheme-name
N/A
3. Set the RADIUS server
response timeout timer.
timer response-timeout seconds
Optional.
The default RADIUS server
response timeout timer is 3
seconds.
4. Set the quiet timer for the
servers.
timer quiet minutes
Optional.
The default quiet timer is 5 minutes.
5. Set the real-time accounting
timer.
timer realtime-accounting minutes
Optional.
The default real-time accounting
timer is 12 minutes.
Configuring RADIUS accounting-on
The accounting-on feature enables a firewall to send accounting-on packets to the RADIUS server after it
reboots, making the server log out users who logged in through the firewall before the reboot. Without
this feature, users who were online before the reboot cannot re-log in after the reboot, because the
RADIUS server considers they are already online.
If a firewall sends an accounting-on packet to the RADIUS server but receives no response, it resends the
packet to the server at a particular interval for a specified number of times.
To configure the accounting-on feature for a RADIUS scheme:
Step Command Remarks
1. Enter system view.
system-view N/A