R3303-HP 6600/HSR6600 Routers Security Configuration Guide

42
Ste
p
Command Remarks
3. Specify a shared key for
secure HWTACACS
authentication, authorization,
or accounting
communication.
key { accounting | authentication |
authorization } [ cipher | simple ]
key
By default, no shared key is
specified.
In FIPS mode, the shared key must
be a string of at least 8 characters
that contain numbers, uppercase
letters, lowercase letters, and
special characters.
The shared key configured on the
device must be the same as that
configured on the HWTACACS
server.
Specifying a VPN for the HWTACACS scheme
You can specify a VPN for all the AAA servers in an HWTACACS scheme. However, the VPN has a
lower priority than those configured for individual HWTACACS servers.
To specify a VPN for an HWTACACS scheme:
Ste
p
Command
1. Enter system view.
system-view
2. Enter HWTACACS scheme view.
hwtacacs scheme hwtacacs-scheme-name
3. Specify a VPN for the HWTACACS scheme.
vpn-instance vpn-instance-name
Setting the username format and traffic statistics units
A username is usually in the format userid@isp-name, where isp-name represents the user's ISP domain
name. By default, the ISP domain name is included in a username; however, some HWTACACS servers
do not recognize usernames that contain the ISP domain names. In this case, you can configure the
device to remove the domain name from each username to be sent.
The device periodically sends accounting updates to HWTACACS accounting servers to report the traffic
statistics of online users. For normal and accurate traffic statistics, make sure that the unit for data flows
and that for packets on the device are consistent with those configured on the HWTACACS servers.
To set the username format and the traffic statistics units for an HWTACACS scheme:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Enter HWTACACS scheme
view.
hwtacacs scheme
hwtacacs-scheme-name
N/A
3. Set the format of usernames
sent to the HWTACACS
servers.
user-name-format { keep-original |
with-domain | without-domain }
Optional.
By default, the ISP domain name
is included in a username.
4. Specify the unit for data flows
or packets sent to the
HWTACACS servers.
data-flow-format { data { byte |
giga-byte | kilo-byte | mega-byte }
| packet { giga-packet | kilo-packet
| mega-packet | one-packet } }*
Optional.
The default unit is byte for data
flows and one-packet for data
packets.