H3C Technologies H3C SecBlade LB Cards - Manual (Page 69)

58
Step Command Remarks
3. Specify a shared key for
secure RADIUS
authentication/authorization
or accounting
communication.
key { accounting | authentication }
[ cipher | simple ] key
By default, no shared key is
specified.
The shared key configured on the
device must be the same as that
configured on the RADIUS server.
Specifying a VPN for the RADIUS scheme
You can specify a VPN for all the AAA servers in a RADIUS scheme. However, the VPN has a lower
priority than those configured for individual RADIUS servers.
To specify a VPN for a RADIUS scheme:
Step Command
1. Enter system view. system-view
2. Enter RADIUS scheme view. radius scheme radius-scheme-name
3. Specify a VPN for the RADIUS scheme. vpn-instance vpn-instance-name
Setting the username format and traffic statistics units
A username is usually in the format userid@isp-name, where isp-name represents the user's ISP domain
name. By default, the ISP domain name is included in a username; however, some earlier RADIUS
servers do not recognize usernames that contain the ISP domain names. In this case, you can configure
the device to remove the domain name from each username to be sent.
The device periodically sends accounting updates to RADIUS accounting servers to report the traffic
statistics of online users. For normal and accurate traffic statistics, make sure that the unit for data flows
and that for packets on the device are consistent with those on the RADIUS server.
To set the username format and the traffic statistics units for a RADIUS scheme:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter RADIUS scheme view. radius scheme radius-scheme-name N/A
3. Set the format for usernames
sent to the RADIUS servers. user-name-format { keep-original |
with-domain | without-domain }
Optional.
By default, the ISP domain name
is included in a username.
4. Specify the unit for data flows
or packets sent to the RADIUS
servers.
data-flow-format { data { byte |
giga-byte | kilo-byte | mega-byte }
| packet { giga-packet | kilo-packet
| mega-packet | one-packet } }*
Optional.
The default unit is byte for data
flows and one-packet for data
packets.
Do not apply the RADIUS scheme to more than one ISP domain if you have configured the
user-name-format without-domain command for that RADIUS scheme. Otherwise, users in different ISP
domains are considered the same user if they use the same username.
For level switching authentication, user-name-format keep-original and user-name-format
without-domain commands all produce the same results: they make sure that usernames sent to the
RADIUS server carry no ISP domain name.