R0106-HP MSR Router Series Security Command Reference(V7)

58
• simple string: Sets a plaintext shared key. The string argument is case sensitive.
{ In non-FIPS mode, the key is a string of 1 to 64 characters.
{ In FIPS mode, the key is a string of 15 to 64 characters. The string must contain digits, uppercase
letters, lowercase letters, and special characters.
test-profile profile-name: Specifies a test profile for detecting the RADIUS server status. The profile-name
argument specifies the test profile name, which is a case-sensitive string of 1 to 31 characters.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN to which the primary RADIUS authentication
server belongs, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the server is
on the public network, do not specify this option.
Usage guidelines
Make sure that the service port and shared key settings of the primary RADIUS authentication server are
the same as those configured on the server.
Two authentication servers specified for a scheme, primary or secondary, cannot have identical IP
address, port number, and VPN settings.
The shared key configured by this command takes precedence over the shared key configured with the
key authentication command.
When you specify a test profile for the primary authentication server, make sure the test profile already
exists on the device. Otherwise, the device cannot detect the server status.
If the specified server resides on an MPLS L3VPN, specify the VPN by using the vpn-instance
vpn-instance-name option. The VPN specified by this command takes precedence over the VPN
specified for the RADIUS scheme.
If you use the primary authentication command to modify or delete the primary authentication server
during an authentication process, communication with the primary server times out. The device tries to
communicate with an active server that has the highest priority for authentication.
For security purposes, all shared keys, including shared keys configured in plain text, are saved in
ciphertext.
Examples
# Specify the primary authentication server with IP address 10.110 .1.1, U D P p o r t n u m b e r 1812, a n d
plaintext shared key 123456TESTauth&! for RADIUS scheme radius1.
<Sysname> system-view
[Sysname] radius scheme radius1
[Sysname-radius-radius1] primary authentication 10.110.1.1 1812 key simple
123456TESTauth&!
Related commands
• display radius scheme
• key (RADIUS scheme view)
• radius-server test-profile
• secondary authentication (RADIUS scheme view)
• vpn-instance (RADIUS scheme view)
radius-server test-profile
Use radius-server test-profile to configure a test profile for detecting the RADIUS server status.