R3721-F3210-F3171-HP High-End Firewalls Access Control Configuration Guide-6PW101

206
Ste
p
Command Remarks
2. Enter HWTACACS
scheme view.
hwtacacs scheme
hwtacacs-scheme-name
N/A
3. Specify a source IP
address for outgoing
HWTACACS packets.
nas-ip ip-address
By default, the IP address of the outbound
interface is used as the source IP address.
Setting timers for controlling communication with HWTACACS servers
The firewall uses the following timers to control the communication with an HWTACACS server:
• Server response timeout timer (response-timeout)—Defines the HWTACACS request
retransmission interval. After sending an HWTACACS request (authentication, authorization, or
accounting request), the firewall starts this timer. If the firewall receives no response from the server
before this timer expires, it resends the request.
• Server quiet timer (quiet)—Defines the duration to keep an unreachable server in blocked state. If
a server is not reachable, the firewall changes the server's status to blocked, starts this timer for the
server, and tries to communicate with another server in active state. After this timer expires, the
firewall changes the status of the server back to active.
• Real-time accounting timer (realtime-accounting)—Defines the interval at which the firewall sends
real-time accounting updates to the HWTACACS accounting server for online users. To implement
real-time accounting, the firewall must send real-time accounting packets to the accounting server
for online users periodically.
To set timers for controlling communication with HWTACACS servers:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enter HWTACACS scheme view. hwtacacs scheme hwtacacs-scheme-name N/A
3. Set the HWTACACS server
response timeout timer.
timer response-timeout seconds
Optional.
The default
HWTACACS server
response timeout timer
is 5 seconds.
4. Set the quiet timer for the primary
server.
timer quiet minutes
Optional.
The default quiet timer
for the primary server is
5 minutes.
5. Set the real-time accounting
interval.
timer realtime-accounting minutes
Optional.
The default real-time
accounting interval is
12 minutes.
NOTE:
Consider the performance of the NAS and the HWTACACS server when you set the real-time accountin
g
interval. A shorter interval requires higher performance.