H3C S7500 Series Ethernet Switches Operation Manual

Operation Manual – AAA & RADIUS & HWTACACS & EAD
H3C S7500 Series Ethernet Switches
Chapter 1 AAA & RADIUS & HWTACACS
Configuration
1-36
Caution:
z The primary and secondary accounting servers cannot use the same IP address.
Otherwise, the system will prompt unsuccessful configuration.
z You can remove a server only when it is not being used by any active TCP
connection for sending accounting packets.
z Currently, HWTACACS does not support the accounting of FTP users.
1.5.5 Configuring Shared Keys for HWTACACS Packets
When using a TACACS server as an AAA server, you can set a key to improve the
communication security between the router and the TACACS server.
The TACACS client (device system) and server adopt MD5 algorithm to encrypt the
exchanged HWTACACS packets. The two parties verify the validity of the exchanged
packets by using the shared keys that have been set on them, and can accept and
respond to the packets sent from each other only if both of them have the same shared
keys. Therefore, make sure the shared key set on the device and that on TACACS
server are the same.
Table 1-27 Configure shared keys for HWTACACS packets
To do... Use the command... Remarks
Enter system view
system-view
—
Create a HWTACACS
scheme and enter its view
hwtacacs scheme
hwtacacs-scheme-name
Required
By default, no
HWTACACS scheme
exists.
Set a shared key for the
HWTACACS
accounting/authentication
/authorization packets
key { accounting |
authorization |
authentication } string
Required
By default, the TACACS
server does not have a
key.