R3102-R3103-HP 6600/HSR6600 Routers Security Configuration Guide
43
If an HWTACACS server does not support a username that carries the domain name, configure the
device to remove the domain name before sending the username to the server.
For level switching authentication, user-name-format keep-original and user-name-format
without-domain commands all produce the same results: they make sure that usernames sent to the
HWTACACS server carry no ISP domain name.
Specifying the source IP address for outgoing HWTACACS packets
The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS
configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon
receiving an HWTACACS packet, an HWTACACS server checks whether the source IP address of the
packet is the IP address of any managed NAS. If yes, the server processes the packet. If not, the server
drops the packet.
The source address of outgoing HWTACACS packets is typically the IP address of the NAS's any
interface that can communicate with the HWTACACS server. In some cases, however, you must change
the source IP address. For example, if the NAS is configured with VRRP for stateful failover, the source IP
address of HWTACACS packets can be the virtual IP address of the uplink VRRP group.
You can specify the source IP address for outgoing HWTACACS packets in HWTACACS scheme view for
a specific HWTACACS scheme, or in system view for all HWTACACS schemes whose servers are in a
VPN or the public network.
Before sending an HWTACACS packet, the NAS selects a source IP address in the following order:
1. The source IP address specified for the HWTACACS scheme.
2. The source IP address specified in system view for the VPN or public network, depending on where
the HWTACACS server resides.
3. The IP address of the outbound interface specified by the route.
To specify a source IP address for all HWTACACS schemes of a VPN or the public network:
Ste
p
Command
Remarks
1. Enter system view.
system-view N/A
2. Specify a source IP address
for outgoing HWTACACS
packets.
hwtacacs nas-ip ip-address
[ vpn-instance vpn-instance-name ]
By default, the IP address of the
outbound interface is used as the
source IP address.
To specify a source IP address for a specific HWTACACS scheme:
Ste
p
Command
Remarks
1. Enter system view.
system-view N/A
2. Enter HWTACACS scheme
view.
hwtacacs scheme
hwtacacs-scheme-name
N/A
3. Specify a source IP address
for outgoing HWTACACS
packets.
nas-ip ip-address
By default, the IP address of the
outbound interface is used as the
source IP address.
Setting HWTACACS timers
The device uses the following timers to control the communication with an HWTACACS server: