Configuring RADIUS schemes

A RADIUS scheme specifies the RADIUS servers that the switch can cooperate with and defines a set of parameters that the switch uses to exchange information with the RADIUS servers. There may be authentication/authorization servers and accounting servers, or primary servers and secondary servers. The parameters include the IP addresses of the servers, the shared keys, and the RADIUS server type.

RADIUS scheme configuration task list

Creating a RADIUS scheme

Before performing other RADIUS configurations, follow these steps to create a RADIUS scheme and enter RADIUS scheme view:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Create a RADIUS scheme and enter RADIUS scheme view.

radius scheme radius-scheme-name

No RADIUS scheme exists by default.


[NOTE: ]

NOTE:

A RADIUS scheme can be referenced by multiple ISP domains at the same time.


Specifying the RADIUS authentication/authorization servers

You can specify one primary authentication/authorization server and up to 16 secondary authentication/authorization servers for a RADIUS scheme. When the primary server is not available, the switch searches for the secondary servers in the order they are configured. The first secondary server in active state is used for communication.

If redundancy is not required, specify only the primary server.

In RADIUS, user authorization information is piggybacked in authentication responses sent to RADIUS clients. There is no separate RADIUS authorization server.

You can enable the server status detection feature. With the feature, the switch periodically sends an authentication request to check whether or not the target RADIUS authentication/authorization server is reachable. If yes, the switch sets the status of the server to active. If not, the switch sets the status of the server to block. This feature can promptly notify authentication modules of latest server status information. For example, server status detection can work with the 802.1X critical VLAN feature, so that the switch can trigger 802.1X authentication for users in the critical VLAN immediately on detection of a reachable RADIUS authentication/authorization server.

Follow these guidelines when you specify RADIUS authentication/authorization servers:

To specify RADIUS authentication/authorization servers for a RADIUS scheme:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enter RADIUS scheme view.

radius scheme radius-scheme-name

N/A

3. Specify RADIUS authentication/authorization servers.

  • Specify the primary RADIUS authentication/authorization server:primary authentication { ip-address | ipv6 ipv6-address } [ port-number | key [ cipher | simple ] key | probe username name [ interval interval ] ] *

  • Specify a secondary RADIUS authentication/authorization server:secondary authentication { ip-address | ipv6 ipv6-address } [ port-number | key [ cipher | simple ] key | probe username name [ interval interval ] ] *

Configure at least one command.

No authentication/authorization server is specified by default.

Specifying the RADIUS accounting servers and the relevant parameters

You can specify one primary accounting server and up to 16 secondary accounting servers for a RADIUS scheme. When the primary server is not available, the switch searches for the secondary servers in the order they are configured. The first secondary server in active state is used for communication.

If redundancy is not required, specify only the primary server.

By setting the maximum number of real-time accounting attempts for a scheme, you make the switch disconnect users for whom no accounting response is received before the number of accounting attempts reaches the limit.

When the switch receives a connection teardown request from a host or a connection teardown notification from an administrator, it sends a stop-accounting request to the accounting server. You can enable buffering of non-responded stop-accounting requests to allow the switch to buffer and resend a stop-accounting request until it receives a response or the number of stop-accounting attempts reaches the configured limit. In the latter case, the switch discards the packet.

Follow these guidelines when you specify RADIUS accounting servers:

To specify RADIUS accounting servers and set relevant parameters for a scheme:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enter RADIUS scheme view.

radius scheme radius-scheme-name

N/A

3. Specify RADIUS accounting servers.

  • Specify the primary RADIUS accounting server:primary accounting { ip-address | ipv6 ipv6-address } [ port-number | key [ cipher | simple ] key ] *

  • Specify a secondary RADIUS accounting server:secondary accounting { ip-address | ipv6 ipv6-address } [ port-number | key [ cipher | simple ] key ] *

Configure at least one command.

No accounting server is specified by default.

4. Set the maximum number of real-time accounting attempts.

retry realtime-accounting retry-times

Optional.

The default setting is 5.

5. Enable buffering of stop-accounting requests to which no responses are received.

stop-accounting-buffer enable

Optional.

Enabled by default.

6. Set the maximum number of stop-accounting attempts.

retry stop-accounting retry-times

Optional.

The default setting is 500.

Specifying the shared keys for secure RADIUS communication

The RADIUS client and RADIUS server use the MD5 algorithm to authenticate packets exchanged between them and use shared keys for packet authentication and user passwords encryption. They must use the same key for the same type of communication.

A shared key configured in this task is for all servers of the same type (accounting or authentication) in the scheme, and has a lower priority than a shared key configured individually for a RADIUS server.

To specify a shared key for secure RADIUS communication:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enter RADIUS scheme view.

radius scheme radius-scheme-name

N/A

3. Specify a shared key for secure RADIUS authentication/authorization or accounting communication.

key { accounting | authentication [ cipher | simple ] } key

No shared key is specified by default.


[NOTE: ]

NOTE:

A shared key configured on the switch must be the same as that configured on the RADIUS server.


Setting the username format and traffic statistics units

A username is usually in the format of userid@isp-name, where isp-name represents the name of the ISP domain the user belongs to and is used by the switch to determine which users belong to which ISP domains. However, some earlier RADIUS servers cannot recognize usernames that contain an ISP domain name. In this case, the switch must remove the domain name of each username before sending the username. You can set the username format on the switch for this purpose.

The switch periodically sends accounting updates to RADIUS accounting servers to report the traffic statistics of online users. For normal and accurate traffic statistics, make sure the unit for data flows and that for packets on the switch are consistent with those on the RADIUS server.

Follow these guidelines when you set the username format and the traffic statistics units for a RADIUS scheme:

To set the username format and the traffic statistics units for a RADIUS scheme:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enter RADIUS scheme view.

radius scheme radius-scheme-name

N/A

3. Set the format for usernames sent to the RADIUS servers.

user-name-format { keep-original | with-domain | without-domain }

Optional.

By default, the ISP domain name is included in a username.

4. Specify the unit for data flows or packets sent to the RADIUS servers.

data-flow-format { data { byte | giga-byte | kilo-byte | mega-byte } | packet { giga-packet | kilo-packet | mega-packet | one-packet } }*

Optional.

The default unit is byte for data flows and is one-packet for data packets.

Setting the supported RADIUS server type

The supported RADIUS server type determines the type of the RADIUS protocol that the switch uses to communicate with the RADIUS server. It can be standard or extended:

When the RADIUS server runs on IMC, you must set the RADIUS server type to extended. When the RADIUS server runs third-party RADIUS server software, either RADIUS server type applies. For the switch to function as a RADIUS server to authenticate login users, you must set the RADIUS server type to standard.

To set the RADIUS server type:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enter RADIUS scheme view.

radius scheme radius-scheme-name

N/A

3. Set the RADIUS server type.

server-type { extended | standard }

Optional.

The default RADIUS server type is standard.


[NOTE: ]

NOTE:

Changing the RADIUS server type restores the unit for data flows and that for packets that are sent to the RADIUS server to the defaults.


Setting the maximum number of RADIUS request transmission attempts

Because RADIUS uses UDP packets to transfer data, the communication process is not reliable. RADIUS uses a retransmission mechanism to improve the reliability. If a NAS sends a RADIUS request to a RADIUS server but receives no response after the response timeout timer (defined by the timer response-timeout command) expires, it retransmits the request. If the number of transmission attempts exceeds the specified limit but it still receives no response, it tries to communicate with other RADIUS servers in active state. If no other servers are in active state at the time, it considers the authentication or accounting attempt a failure. For more information about RADIUS server states, see "Setting the status of RADIUS servers."

To set the maximum number of RADIUS request transmission attempts for a scheme:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enter RADIUS scheme view.

radius scheme radius-scheme-name

N/A

3. Set the maximum number of RADIUS request transmission attempts.

retry retry-times

Optional.

The default setting is 3.


[NOTE: ]

NOTE:

  • The maximum number of transmission attempts of RADIUS packets multiplied by the RADIUS server response timeout period cannot be greater than 75 seconds.

  • For more information about the RADIUS server response timeout period, see "Setting timers for controlling communication with RADIUS servers."


  • Setting the status of RADIUS servers

    By setting the status of RADIUS servers to blocked or active, you can control which servers the switch communicates with for authentication, authorization, and accounting or turn to when the current servers are no longer available. In practice, you can specify one primary RADIUS server and multiple secondary RADIUS servers, with the secondary servers functioning as the backup of the primary servers. Generally, the switch chooses servers based on these rules:

    The device does not change the status of an unreachable authentication or accounting server if the server quiet timer is set to 0. Instead, the device keeps the server status as active and sends authentication or accounting packets to another server in active state, so subsequent authentication or accounting packets can still be sent to that server. For more information about the server quiet timer, see "Setting timers for controlling communication with HWTACACS servers."

    By default, the switch sets the status of all RADIUS servers to active. In cases such as a server failure, you can change the status of the server to blocked to avoid communication with the server.

    To set the status of RADIUS servers in a RADIUS scheme:

    Step

    Command

    Remarks

    1. Enter system view.

    system-view

    N/A

    2. Enter RADIUS scheme view.

    radius scheme radius-scheme-name

    N/A

    3. Set the RADIUS server status.

    • Set the status of the primary RADIUS authentication/authorization server:state primary authentication { active | block }

    • Set the status of the primary RADIUS accounting server:state primary accounting { active | block }

    • Set the status of a secondary RADIUS authentication/authorization server:state secondary authentication [ ip ipv4-address | ipv6 ipv6-address ] { active | block }

    • Set the status of a secondary RADIUS accounting server:state secondary accounting [ ip ipv4-address | ipv6 ipv6-address ] { active | block }

    Optional.

    By default, all servers in the RADIUS scheme are in active state.


    [NOTE: ]

    NOTE:

  • The server status set by the state command cannot be saved to the configuration file. After the switch restarts, the status of each server is restored to active.

  • To display the states of the servers, use the display radius scheme command.


  • Specifying the source IP address for outgoing RADIUS packets

    The source IP address of RADIUS packets that a NAS sends must match the IP address of the NAS configured on the RADIUS server. A RADIUS server identifies a NAS by its IP address. Upon receiving a RADIUS packet, a RADIUS server checks whether the source IP address of the packet is the IP address of any managed NAS. If yes, the server processes the packet. If not, the server drops the packet.

    You can specify a source IP address for outgoing RADIUS packets in RADIUS scheme view for a specific RADIUS scheme, or in system view for all RADIUS schemes. Before sending a RADIUS packet, a NAS selects a source IP address in the following order:

    To specify a source IP address for all RADIUS schemes:

    Step

    Command

    Remarks

    1. Enter system view.

    system-view

    N/A

    2. Specify a source IP address for outgoing RADIUS packets.

    radius nas-ip { ip-address | ipv6 ipv6-address }

    By default, the IP address of the outbound interface is used as the source IP address.

    To specify a source IP address for a specific RADIUS scheme:

    Step

    Command

    Remarks

    1. Enter system view.

    system-view

    N/A

    2. Enter RADIUS scheme view.

    radius scheme radius-scheme-name

    N/A

    3. Specify a source IP address for outgoing RADIUS packets.

    nas-ip { ip-address | ipv6 ipv6-address }

    By default, the IP address of the outbound interface is used as the source IP address.

    Setting timers for controlling communication with RADIUS servers

    The switch uses the following types of timers to control the communication with a RADIUS server:

    To set timers for controlling communication with RADIUS servers:

    Step

    Command

    Remarks

    1. Enter system view.

    system-view

    N/A

    2. Enter RADIUS scheme view.

    radius scheme radius-scheme-name

    N/A

    3. Set the RADIUS server response timeout timer.

    timer response-timeout seconds

    Optional.

    The default RADIUS server response timeout timer is 3 seconds.

    4. Set the quiet timer for the servers.

    timer quiet minutes

    Optional.

    The quiet timer is 5 minutes.

    5. Set the real-time accounting timer.

    timer realtime-accounting minutes

    Optional.

    The default real-time accounting timer is 12 minutes.

    Configuring RADIUS accounting-on

    The accounting-on feature enables a switch to send accounting-on packets to the RADIUS server after it reboots, making the server log out users who logged in through the switch before the reboot. Without this feature, users who were online before the reboot cannot re-log in after the reboot, because the RADIUS server considers they are already online.

    If a switch sends an accounting-on packet to the RADIUS server but receives no response, it resends the packet to the server at a particular interval for a specified number of times.

    To configure the accounting-on feature for a RADIUS scheme:

    Step

    Command

    Remarks

    1. Enter system view.

    system-view

    N/A

    2. Enter RADIUS scheme view.

    radius scheme radius-scheme-name

    N/A

    3. Enable accounting-on and configure parameters.

    accounting-on enable [ interval seconds | send send-times ] *

    Disabled by default.

    The default interval is 3 seconds and the default number of send-times is 50.


    [NOTE: ]

    NOTE:

    The accounting-on feature requires the cooperation of the HPE IMC network management system.


    Configuring the IP address of the security policy server

    The core of the HPE EAD solution is integration and cooperation, and the security policy server is the management and control center. Using a collection of software, the security policy server provides functions such as user management, security policy management, security status assessment, security cooperation control, and security event audit.

    The NAS checks the validity of received control packets and accepts only control packets from known servers. To use a security policy server that is independent of the AAA servers, you must configure the IP address of the security policy server on the NAS. To implement all EAD functions, configure both the IP address of the security policy server and that of the IMC Platform on the NAS.

    To configure the IP address of the security policy server for a scheme:

    Step

    Command

    Remarks

    1. Enter system view.

    system-view

    N/A

    2. Enter RADIUS scheme view.

    radius scheme radius-scheme-name

    N/A

    3. Specify a security policy server.

    security-policy-server { ipv4-address | ipv6 ipv6-address }

    No security policy server is specified by default.

    Configuring interpretation of RADIUS class attribute as CAR parameters

    According to RFC 2865, a RADIUS server assigns the RADIUS class attribute (attribute 25) to a RADIUS client. However, the RFC only requires the RADIUS client to send the attribute to the accounting server on an "as is" basis. It does not require the RADIUS client to interpret the attribute. Some RADIUS servers use the class attribute to deliver the assigned committed access rate (CAR) parameters. In this case, the switch must interpret the attribute as the CAR parameters to implement user-based traffic monitoring and controlling.

    To configure the switch to interpret the RADIUS class attribute as CAR parameters:

    Step

    Command

    Remarks

    1. Enter system view.

    system-view

    N/A

    2. Enter RADIUS scheme view.

    radius scheme radius-scheme-name

    N/A

    3. Interpret the class attribute as CAR parameters.

    attribute 25 car

    By default, RADIUS attribute 25 is not interpreted as CAR parameters.


    [NOTE: ]

    NOTE:

    Whether interpretation of RADIUS class attribute as CAR parameters is supported depends on two factors:

  • Whether the switch supports CAR parameters assignment.

  • Whether the RADIUS server supports assigning CAR parameters through the class attribute.


  • Enabling the trap function for RADIUS

    With the trap function, a NAS sends a trap message when either of the following events occurs:

    The failure ratio is generally small. If a trap message is triggered because the failure ratio is higher than the threshold, troubleshoot the configuration on and the communication between the NAS and the RADIUS server.

    To enable the trap function for RADIUS:

    Step

    Command

    Remarks

    1. Enter system view.

    system-view

    N/A

    2. Enable the trap function for RADIUS.

    radius trap { accounting-server-down | authentication-error-threshold | authentication-server-down }

    Disabled by default.

    Enabling the RADIUS client service

    To receive and send RADIUS packets, enable the RADIUS client service on the device. If RADIUS is not required, disable the RADIUS client service to avoid attacks that exploit RADIUS packets.

    To enable the RADIUS client service:

    Step

    Command

    Remarks

    1. Enter system view.

    system-view

    N/A

    2. Enable the RADIUS client service.

    radius client enable

    Optional.

    Enabled by default.

    Setting the DSCP value for RADIUS packets

    Step

    Command

    Remarks

    1. Enter system view.

    system-view

    N/A

    2. Set the DSCP value for IPv4 RADIUS packets.

    radius dscp dscp-value

    Optional.

    The default DSCP value is 0.

    3. Set the DSCP value for IPv6 RADIUS packets.

    radius ipv6 dscp dscp-value

    Optional.

    The default DSCP value is 0.

    Displaying and maintaining RADIUS

    Task

    Command

    Remarks

    Display the configuration information of RADIUS schemes.

    display radius scheme [ radius-scheme-name ] [ slot slot-number ] [ | { begin | exclude | include } regular-expression ]

    Available in any view

    Display the statistics for RADIUS packets.

    display radius statistics [ slot slot-number ] [ | { begin | exclude | include } regular-expression ]

    Available in any view

    Display information about buffered stop-accounting requests for which no responses have been received.

    display stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time stop-time | user-name user-name } [ slot slot-number ] [ | { begin | exclude | include } regular-expression ]

    Available in any view

    Clear RADIUS statistics.

    reset radius statistics [ slot slot-number ]

    Available in user view

    Clear the buffered stop-accounting requests for which no responses have been receive.

    reset stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time stop-time | user-name user-name } [ slot slot-number ]

    Available in user view