H3C Technologies H3C SecBlade LB Cards - Manual (Page 81)

70
The source address of outgoing HWTACACS packets is typically the IP address of an egress interface on
the NAS to communicate with the HWTACACS server. In some cases, however, you must change the
source IP address. For example, if a NAT device is present between the NAS and the HWTACACS server,
the source IP address of outgoing HWTACACS packets must be a public IP address of the NAS. If the
NAS is configured with VRRP for stateful failover, the source IP address of HWTACACS packets can be
the virtual IP address of the uplink VRRP group.
You can specify the source IP address for outgoing HWTACACS packets in HWTACACS scheme view for
a specific HWTACACS scheme, or in system view for all HWTACACS schemes whose servers are in a
VPN or the public network.
Before sending an HWTACACS packet, the NAS selects a source IP address in the following order:
1. The source IP address specified for the HWTACACS scheme.
2. The source IP address specified in system view for the VPN or public network, depending on where
the HWTACACS server resides.
3. The IP address of the outbound interface specified by the route.
To specify a source IP address for all HWTACACS schemes of a VPN or the public network:
Step Command Remarks
1. Enter system view. system-view N/A
2. Specify a source IP address
for outgoing HWTACACS
packets.
hwtacacs nas-ip ip-address
[ vpn-instance vpn-instance-name ]
By default, the IP address of the
outbound interface is used as the
source IP address.
To specify a source IP address for a specific HWTACACS scheme:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter HWTACACS scheme
view.
hwtacacs scheme
hwtacacs-scheme-name
N/A
3. Specify a source IP address
for outgoing HWTACACS
packets. nas-ip ip-address
By default, the IP address of the
outbound interface is used as the
source IP address.
Setting HWTACACS timers
The device uses the following timers to control the communication with an HWTACACS server:
• Server response timeout timer (response-timeout)—Defines the HWTACACS request
retransmission interval. After sending an HWTACACS request (authentication, authorization, or
accounting request), the device starts the server response timeout timer. If the device receives no
response from the server before the timer expires, it resends the request.
• Primary server quiet timer (quiet)—Defines the duration to keep an unreachable primary server in
blocked state. If a primary server is not reachable, the device changes the server's status to blocked,
starts this timer for the server, and tries to communicate with the secondary server if the secondary
server is configured and in active state. After the primary server quiet timer expires, the device
changes the status of the primary server back to active.
• Real-time accounting timer (realtime-accounting)—Defines the interval at which the device sends
real-time accounting updates to the HWTACACS accounting server for online users. To implement