H3C S7500E Series Ethernet Switches Operation Manual

Operation Manual – AAA RADIUS HWTACACS
H3C S7500E Series Ethernet Switches
Chapter 1 AAA/RADIUS/HWTACACS
Configuration
1-42
[Switch-radius-rd] quit
# Create local user named telnet.
[Switch] local-user hello
[Switch-luser-hello] service-type telnet
[Switch-luser-hello] password simple hello
[Switch-luser-hello] quit
# Configure the AAA schemes of the ISP domain.
[Switch] domain bbb
[Switch-isp-bbb] authentication login local
[Switch-isp-bbb] authorization login hwtacacs-scheme hwtac
[Switch-isp-bbb] accounting login radius-scheme rd
[Switch-isp-bbb] quit
# Configure the default AAA schemes for all types of users.
[Switch] domain bbb
[Switch-isp-bbb] authentication default local
[Switch-isp-bbb] authorization default hwtacacs-scheme hwtac
[Switch-isp-bbb] accounting default radius-scheme cams
When telneting into the switch, a user enters username telnet@bbb for authentication
using domain bbb.
1.8 Troubleshooting AAA/RADIUS/HWTACACS
1.8.1 Troubleshooting RADIUS
Symptom1: User authentication/authorization always fails.
Analysis:
1) A communication failure exists between the NAS and the RADIUS server.
2) The username is not in the format of userid@isp-name or no default ISP domain is
specified for the NAS.
3) The user is not configured on the RADIUS server.
4) The password of the user is incorrect.
5) The RADIUS server and the NAS are configured with different shared key.
Solution:
Check that:
1) The NAS and the RADIUS server can ping each other.
2) The username is in the userid@isp-name format and a default ISP domain is
specified on the NAS.
3) The user is configured on the RADIUS server.
4) The password entered by the user is correct.
5) The same shared key is configured on both the RADIUS server and the NAS.