HP 12500 Series Configuration Manual page 48

NOTE:
An HWTACACS server can function as the primary authentication server of one scheme and as the
•
secondary authentication server of another scheme at the same time.
• The IP addresses of the primary and secondary authentication servers cannot be the same. Otherwise,
the configuration fails.
You can remove an authentication server only when no active TCP connection for sending authentication
•
packets is using it.
Specifying the HWTACACS authorization servers
You can specify one primary authorization server and up to one secondary authorization server for an
HWTACACS scheme so that the NAS can find a server for user authorization when using the scheme.
When the primary server is not available, the secondary server is used. In a scenario where redundancy
is not required, specify only the primary server.
To specify HWTACACS authorization servers for an HWTACACS scheme:
Step
1. Enter system view.
2. Enter HWTACACS
scheme view.
Specify HWTACACS
3.
authorization servers.
NOTE:
An HWTACACS server can function as the primary authorization server of one scheme and as the
•
secondary authorization server of another scheme at the same time.
The IP addresses of the primary and secondary authorization servers cannot be the same. Otherwise,
•
the configuration fails.
You can remove an authorization server only when no active TCP connection for sending authorization
•
packets is using it.
Specifying the HWTACACS accounting servers and the relevant parameters
You can specify one primary accounting server and up to one secondary accounting server for an
HWTACACS scheme so that the NAS can find a server for user accounting when using the scheme.
When the primary server is not available, the secondary server is used. In a scenario where redundancy
is not required, specify only the primary server.
When the switch receives a connection teardown request from a host or a connection teardown
command from an administrator, it sends a stop-accounting request to the accounting server. You can
enable buffering of non-responded stop-accounting requests to allow the switch to buffer and resend a
Command
system-view
hwtacacs scheme
hwtacacs-scheme-name
Specify the primary HWTACACS
authorization server:
primary authorization ip-address
[ port-number | vpn-instance
vpn-instance-name ] *
Specify the secondary HWTACACS
authorization server:
secondary authorization ip-address
[ port-number | vpn-instance
vpn-instance-name ] *
38
Remarks
N/A
N/A
Configure at least one command.
No authorization server is
specified by default.