The Called-station-id (Type 30) attribute indicates the MAC address and SSID of an AP. The default format of the MAC address in the called-station-id attribute of RADIUS packets from the device is XX-XX-XX-XX-XX-XX. If the RADIUS server does not support the default format, run the called-station-id mac-format command to change the format.

The default format of the MAC address in the calling-station-id (Type 31) attribute of RADIUS packets from the device is xxxx-xxxx-xxxx. If the RADIUS server does not support the default format, run the calling-station-id mac-format command to change the format.

Before connecting the device to a RADIUS server, run the display radius-attribute command to view the RADIUS attributes supported by the device. If the device and RADIUS server support different RADIUS attributes according to the command output, run the radius-attribute disable command on the device to disable RADIUS attributes that are not supported by the RADIUS server or run the radius-attribute translate command to translate RADIUS attributes.

After the radius-attribute check command is executed to configure the attributes to be checked in RADIUS Access-Accept packets, you can use the display radius-attribute check command to view these attributes.

You can use the display radius-attribute disable command to view the RADIUS attributes disabled by using the radius-attribute disable command.

To enable a RADIUS attribute, run the undo radius-attribute disable command in the RADIUS server template view.

After running the radius-attribute translate command to configure the device to translate RADIUS attributes, run the display radius-attribute translate command to check the configuration.

The display radius-server accounting-stop-packet command output helps you check configurations or isolate faults.

You can run this command to check whether the configuration of a RADIUS authorization server is correct.

After the configuration of a RADIUS server template is completed or a RADIUS fault needs to be rectified, you can run this command to check whether the configuration of the RADIUS server template is correct.

After the RADIUS server detection interval, number of times the RADIUS server detection interval cycles, and maximum number of consecutive unacknowledged packets in each detection interval are configured using the radius-server dead-interval dead-count detect-cycle command, you can run the display radius-server { dead-interval | dead-count | detect-cycle } command to check configuration information about the RADIUS server detection interval, number of times the RADIUS server detection interval cycles, and maximum number of consecutive unacknowledged packets in each detection interval.

After session management is enabled using the radius-server session-manage command on the RADIUS server, you can run this command to view session management configuration.

The display radius-server item command shows the RADIUS server configuration.

After the longest unresponsive interval of a RADIUS server is configured using the radius-server max-unresponsive-interval command, you can run the display radius-server max-unresponsive-interval command to display configuration information about the longest unresponsive interval of the RADIUS server.

Usage Scenario

After enabling the trap function for the RDS module, you can run the display snmp-agent trap feature-name radius all command to check the status of all traps for the RDS module. To enable the trap function for the RDS module, run the snmp-agent trap enable feature-name radius command.

Prerequisites

The SNMP function has been enabled on the device.

Usage Scenario

After the radius-attribute check command is executed, the device checks whether the received RADIUS Access-Accept packets contain the specified attributes. If yes, the device considers that authentication was successful; if not, the device considers that authentication failed and discards the packet. For example, after the radius-attribute check filter-id command is executed, the device checks the filter-id attribute in the received RADIUS Access-Accept packets. If a RADIUS packet does not contain this attribute, authentication fails.

Precautions

• When you use the undo radius-attribute check command with parameters, the device checks the specified attributes in the RADIUS Access-Accept packets. When you use the undo radius-attribute check command without any parameter, the device does not check RADIUS Access-Accept packets.
• The display radius-attribute can display RADIUS attribute names.

This command is used to perform special processing on the URL delivered by the RADIUS server using the Huawei RADIUS attribute 26-156 (HW-Portal-URL) to meet interconnection requirements. Generally, this command does not need to be configured.

During RADIUS attribute encapsulation, the device appends some variable-length attributes to packets to improve performance. However, the device may fail to communicate with RADIUS servers of some vendors. In this case, you can run the radius-attribute encap optimize disable command on the device to disable RADIUS attribute encapsulation optimization and then perform the interconnection test.

Usage Scenario

Generally, a RADIUS server connects to multiple network devices, which can be one vendor's devices or different vendors' devices. If some vendors' devices require the RADIUS server to deliver an attribute to support a specified feature but other vendors' device do not support the delivered attribute, the RADIUS attribute may fail to be parsed.

The device may communicate with RADIUS servers of different vendors. Some RADIUS servers require the device to send some attributes but other RADIUS servers cannot process the attributes. Errors may occur.

The radius-attribute disable command disables RADIUS attributes on the device. You can configure the device to ignore incompatible attributes when receiving RADIUS packets to prevent parsing failures. You can also configure the device to disable RADIUS attributes when sending RADIUS packets. When the device sends RADIUS packets, it does not encapsulate the disabled RADIUS attributes in the RADIUS packets.

Prerequisites

The RADIUS attribute translation function has been enabled using the radius-server attribute translate command.

Precautions

Before disabling RADIUS attributes, run the display radius-attribute command to view the RADIUS attributes supported by the device.

Usage Scenario

A RADIUS server uses the NAS-IP-Address attributes in RADIUS packets sent by NASs to identify NASs. You can run the radius-attribute nas-ip command in the RADIUS server template view to set the NAS-IP-Address attribute.

When the RADIUS server interconnected with the device requires that the NAS-IP-Address attribute value is the IP address of the AP when the device functions as an AC in a wireless scenario, you need to run the radius-attribute nas-ip ap-info command.

Prerequisites

A RADIUS server template has been created using the radius-server template command.

Precautions

If the RADIUS NAS-IP-Address attribute is set to an invalid IP address, the configuration fails and an error message is displayed.

Usage Scenario

The RADIUS server uses IP addresses to identify different NASs. The NAS-IPv6-Address attribute in a RADIUS packet can be configured using the radius-attribute nas-ipv6 command in the RADIUS template.

Prerequisites

A RADIUS server template has been created using the radius-server template command.

Precautions

If the RADIUS NAS-IP-Address attribute is set to an invalid IP address, the configuration fails and an error message is displayed.

Usage Scenario

The RADIUS attribute values of different vendors are different. To ensure that Huawei device can successfully communicate with the devices of other vendors, run the radius-attribute set command to modify the RADIUS attribute values.

For example, the Huawei device uses Service-Type value 2 to indicate an authentication request from a common user by default, while a non-Huawei RADIUS server uses Service-Type value 1 to indicate an authentication request from a common user; you can run the radius-attribute set service-type 1 command to change the Service-Type value on the device so that the device can communicate with the RADIUS server.

Precautions

• The radius-attribute set command can modify only the RADIUS attributes in the authentication or accounting request packets sent from a device to the RADIUS server, and cannot modify the RADIUS attributes in the packets sent from the RADIUS server to a device.

  If you run the display radius-attribute command to check the RADIUS attributes supported by a device and the Auth Req or Acct Req field in the command output displays 1, the RADIUS attributes supported by the device can be carried in the authentication or accounting request packets sent from the device to the RADIUS server.

  Among the RADIUS attributes that can be carried in the authentication or accounting packets sent from the device to the RADIUS server, you cannot run the radius-attribute set command to modify the following attributes: User-Password, NAS-IP-Address, NAS-IPv6-Address, CHAP-Password, CHAP-Challenge, EAP-Message, Framed-Interface-Id, Framed-IPv6-Prefix, Message-Authenticator, State, and Class.

• The type of the attribute modified by the radius-attribute set command cannot be changed.

• The radius-attribute set service-type attribute-value { auth-type { mac | dot1x | portal } | user-type ipsession } command has a higher priority than the radius-attribute set service-type attribute-value command.

• A maximum of 8 attributes can be set in a RADIUS server template.

Usage Scenario

If a user needs to be reauthenticated, the device delivers authorization information to all online users after the user is successfully authenticated. If many online users and authorization configurations exist on the device, the device cannot promptly deliver authorization information, causing an authorization failure and user disconnection. After the radius-attribute service-type with-authenonly-reauthen command is run in the RADIUS server template view, the device only reauthenticates users during reauthentication, and does not redeliver authorization information, preventing users from going offline due to authorization failures.

Precautions

After the radius-attribute service-type with-authenonly-reauthen command is configured, users still use the original authorization information after being successfully reauthenticated even if the user authorization information changes.

This function takes effect only when the Service-Type attribute of a RADIUS server is Authenticate Only.

After the reauthentication mode is set to reauthentication only, the user name remains unchanged during reauthentication.

If server authorization packets carry the following attributes during reauthentication, this function does not take effect, but changes to the following authorization are still supported:

• User-Name authorized by the server
• CUI attribute authorized by the server
• Maximum number of users who are allowed to access the network using the same user name

Usage Scenario

Currently, RADIUS servers of different vendors may support different RADIUS attributes and have vendor-specific RADIUS attributes. To communicate with different RADIUS servers, the device provides the RADIUS attribute translation function. After RADIUS attribute translation is enabled, the device can translate RADIUS attributes when sending or receiving packets.

RADIUS attribute translation is used in the following modes:

• Format translation for the same attribute

  This mode is widely applied. It solves the problem of compatibility because different users have different requirements for the format of a RADIUS attribute.

• Translation between different attributes

  This mode is used because different vendors have different implementations of RADIUS attributes.

  For example, the device delivers the priority of the administrator by using the Huawei proprietary attribute HW-Exec-Privilege (26-29), whereas another vendor's device delivers it by using the Login-service (15) attribute. When the device and the vendor's device use the same RADIUS server on a network, the device is required to deliver the priority of the administrator by using the Login-service (15) attribute. After the radius-attribute translate command is configured, the device automatically processes the Login-service attribute in the received RADIUS authentication response packet as the HW-Exec-Privilege attribute.

Prerequisites

RADIUS attribute translation has been enabled by using the radius-server attribute translate command.

Before configuring RADIUS attribute translation, run the display radius-attribute command to view the RADIUS attributes supported by the device.

Precautions

• When the device sends packets, if attribute A is to be translated to attribute B, the type of the encapsulated attribute is the same as that of attribute B but the attribute content and format are the same as those of attribute A.

• When the device receives packets, if attribute A is to be translated to attribute B, the device parses the received attribute A as attribute B.

• When the device receives packets, it cannot translate the attributes of CoA packets.

• Three commands are available to translate RADIUS attributes:

  • To translate the attributes supported by the device to other attributes also supported by the device, run the radius-attribute translate command.
  • To translate the non-Huawei attributes not supported by the device to the attributes supported by the device, run the radius-attribute translate extend vendor-specific command.
  • To translate the attributes supported by the device to the non-Huawei attributes not supported by the device, run the radius-attribute translate extend command.
• The RADIUS attribute consists of Type, Length, and Value fields. A device can translate a non-Huawei RADIUS attribute (specified using the src-sub-id and dest-sub-id parameters) only when the length of the Type field in the RADIUS attribute is 1 byte.

• The device can translate the RADIUS attribute only when the type of the source RADIUS attribute is the same as that of the destination RADIUS attribute. For example, the types of NAS-Identifier and NAS-Port-Id attributes are string, and they can be translated into each other. The types of NAS-Identifier and NAS-Port attributes are string and integer respectively, they cannot be translated into each other.

Usage Scenario

By default, after the RADIUS server responds to a user with an Access-Reject packet, the authentication process ends and the user fails the authentication. If you want administrators to go online through local authentication after they are rejected during RADIUS authentication, run the radius-reject local command.

Precautions

• This function takes effect only for administrators.
• The authentication method must be RADIUS authentication+local authentication.

Usage Scenario

To perform RADIUS authentication and accounting for users in a domain, apply a RADIUS server template to the domain. A RADIUS server template takes effect only after the RADIUS server template is applied to a domain.

Prerequisites

A RADIUS server template has been created using the radius-server template command.

Usage Scenario

To perform accounting for users, configure a RADIUS accounting server. The device communicates with a RADIUS accounting server to obtain accounting information, and performs accounting for users based on the accounting information. The device sends accounting packets to the RADIUS accounting server only after the IP address and port number of the RADIUS accounting server are specified in the RADIUS server template.

Precautions

• The IP address of the primary accounting server must be different from the IP address of the secondary accounting server; otherwise, the configuration fails.
• When the radius-server algorithm master-backup command has been executed to set the algorithm for selecting RADIUS servers to primary/secondary and both the primary and secondary accounting servers have been configured, the device sends accounting request packets to the secondary accounting server when the following two conditions are met:
  1. The primary server does not send any accounting response packet.
  2. The maximum number of times that the device retransmits authentication and accounting packets is reached.
• For the RADIUS server in Down status, if configuration parameters except weight of the RADIUS server are modified, the server status will change from Down to Up.
• The modification of the weight parameter takes effect only for the users who go online after the modification. The users who go online before the modification still send authentication and accounting packets to the selected RADIUS server.

When accounting-stop packets cannot be sent to the RADIUS server that is unreachable, you can run the radius-server accounting-stop-packet resend command to save the accounting-stop packets in the buffer and send them at the preset intervals until the number of allowed retransmission times is reached or the packets are sent successfully.

Usage Scenario

Authentication server information is saved in the authentication phase. If the authentication server is also the accounting server, accounting requests are first sent to this server in the accounting phase. If the accounting packets of the authentication server are unreachable, the accounting server is reselected in the accounting phase. In this case, authentication and accounting of the same user may be performed on different servers.

Precautions

If you run the radius-server algorithm command multiple times in the same RADIUS server template view, only the latest configuration takes effect.

The Message-Authenticator attribute is used to identify and verify authentication packets to prevent invalid packets.

• This command is used when the PAP or CHAP authentication is enabled.
• When EAP authentication is enabled, RADIUS packets contain the Message-Authenticator attribute by default. You do not need to run this command.

Usage Scenario

Currently, RADIUS servers of different vendors may support different RADIUS attributes and have vendor-specific RADIUS attributes. To communicate with different RADIUS servers, the device provides the RADIUS attribute translation function. After RADIUS attribute translation is enabled, the device can translate RADIUS attributes when sending or receiving packets.

Follow-up Procedure

Usage Scenario

To perform RADIUS authentication, configure a RADIUS authentication server in a RADIUS server template. The device uses the RADIUS protocol to communicate with a RADIUS authentication server to obtain authentication information, and authenticates users based on the authentication information. The device sends authentication packets to the RADIUS authentication server only after the IP address and port number of the RADIUS authentication server are specified in the RADIUS server template.

Precautions

• For the RADIUS server in Down status, if configuration parameters except weight of the RADIUS server are modified, the server status will change from Down to Up.
• If an interface connecting the device to a server has multiple IP addresses configured and can communicate with the server only through some of these IP addresses, one IP address among these reachable IP addresses needs to be specified as the source IP address based on the routing table to ensure that the device can communicate with the server.
• The modification of the weight parameter takes effect only for the users who go online after the modification. The users who go online before the modification still send authentication and accounting packets to the selected RADIUS server.
• You are advised to configure different RADIUS servers for the source VLANIF interface, source IP address, and source loopback interface and bind the servers to the same RADIUS template. Otherwise, the device creates multiple RADIUS servers even if the source and destination IP addresses of RADIUS request packets sent by different RADIUS templates are the same. As a result, only the first created RADIUS server receives RADIUS response packets, while other RADIUS servers cannot. To check the RADIUS server configuration, run the display radius-server item ip-address { ipv4-address | ipv6-address } authentication command.

Usage Scenario

After the parameters such as IP address and shared key are configured for the RADIUS authorization server, the device can receive authorization requests from the server and grant rights to users according to the authorization information. After authorization is complete, the device returns authorization response packets carrying the results to the server.

After the security hardening function is enabled by specifying the protect enable parameter, the following occurs:

• When a CoA or DM request packet carries the Message-Authenticator attribute, the device checks the Message-Authenticator attribute. If the check fails, the device discards the request packet and does not respond the packet. If the check succeeds, the device sends a CoA or DM response packet (ACK or NAK) that carries the Message-Authenticator attribute.
• When a CoA or DM request packet does not carry the Message-Authenticator attribute, the device does not check the attribute and sends a CoA or DM response packet (ACK or NAK) that does not carry the Message-Authenticator attribute.

When a CoA or DM request packet carries the Message-Authenticator attribute, if the radius-attribute disable message-authenticator receive command is configured, the device does not check the attribute and sends a response packet that does not carry the Message-Authenticator attribute; if the radius-attribute disable message-authenticator send command is configured, the device sends a response packet that does not carry the Message-Authenticator attribute even if the attribute check succeeds.

Precautions

To improve security, it is recommended that the password contains at least three types of lower-case letters, upper-case letters, numerals, and special characters, and contains at least 16 characters.

You also need to run the radius-server authorization server-source command to configure an IPv4 address for receiving and responding to request packets of a RADIUS authorization server so that the function of the RADIUS authorization server can take effect.

During the configuration of this command, the weak password verification function is added to check whether a password is weak. If the password is weak, the command fails to be executed.

Usage Scenario

By default, no IPv4 address can be used to receive or respond to request packets of the RADIUS authorization server. When the device needs to establish a connection with a RADIUS authorization server, you can run the radius-server authorization server-source command to specify an IPv4 address for the device to receive and respond to request packets of the RADIUS authorization server.

Precautions

• After you run this command to configure an IPv4 address for the device to receive and respond to request packets of a RADIUS authorization server, the RADIUS authorization server can communicate with the device only through this IPv4 address. Ensure that the RADIUS authorization server can communicate with the device through this IPv4 address at Layer 3.

• After the radius-server authorization server-source all-interface command is run, the device receives and responds to request packets of a RADIUS authorization through any IPv4 address, which increases system security risks. Therefore, you are advised not to run this command.

• After the radius-server authorization server-source all-interface command is run, all the configurations of the radius-server authorization server-source ip-address ip-address command are cleared.
• If the radius-server authorization server-source all-interface command has been configured on the device, the radius-server authorization server-source ip-address ip-address command configured later does not take effect.

Usage Scenario

The device parses the MAC address in the Calling-Station-Id attribute in RADIUS dynamic authorization packets. By default, the MAC address format that can be parsed is configured using the radius-server authorization calling-station-id decode-mac-format command in the system view. When the device is connected to multiple RADIUS servers, the MAC address formats are different in the Calling-Station-Id attribute in dynamic authorization packets sent by different RADIUS servers. In this case, the MAC address may fail to be parsed if the same parse mode is used, resulting in that the device fails to be connected to some RADIUS servers. You can run the radius-server authorization attribute-decode-sameastemplate command to configure the device to parse RADIUS dynamic authorization packet attributes based on the Calling-Station-Id attribute encapsulation mode configured in each RADIUS server template, making the device be successfully connected to multiple RADIUS servers.

Prerequisites

This function is used to make the Calling-Station-Id attribute parse mode the same as the Calling-Station-Id attribute encapsulation mode configured in RADIUS server template. Therefore, make sure that the following steps have been performed before using this function.

1. The calling-station-id mac-format command has been run in the RADIUS server template view to configure the encapsulation mode of the MAC address in the Calling-Station-Id attribute.
2. The radius-server authorization command has been run in the system view to configure the authorization server to use the RADIUS server template server-group.

If the RADIUS server template used by the authorization server is not specified, this function cannot be implemented on a device. You can run the radius-server authorization calling-station-id decode-mac-format command in the system view to configure the Calling-Station-Id attribute parse mode.

Precautions

The configuration in a RADIUS server template has a higher priority than the global configuration.

Usage Scenario

The attribute match check function is configured on the RADIUS servers of some vendors. The attribute match check succeeds and the RADIUS server successfully interconnects with a device to implement dynamic authorization or offline operations only when the attribute encapsulation formats in the COA or DM Response packet received by the RADIUS server are the same as those parsed from the RADIUS authentication Response packets. The RADIUS server encapsulates the attributes parsed from the RADIUS Response packet based on the configurations in the RADIUS server template. To ensure that the attribute formats in the COA or DM Response packet are the same as those parsed by the RADIUS server from the RADIUS packet, you can run the radius-server authorization attribute-encode-sameastemplate command to configure the device to encapsulate attributes in the COA or DM Response packet based on the configurations in the RADIUS server template, so that the device is successfully interconnected with the RADIUS server.

Attributes whose encapsulation formats need to be configured in the COA or DM Response packet include Calling-Station-Id (31), NAS-IP-Address (4), and User-Name (1).

Precautions

• This function is used to configure the encapsulation modes of the Calling-Station-Id (31), NAS-IP-Address (4), and User-Name (1) attributes in the COA or DM Response packet to be the same as those configured in the RADIUS server template. Therefore, perform the following steps before using this function.

  1. Configure the encapsulation modes of attributes in the RADIUS server template view.
     • Run the calling-station-id mac-format command to configure the encapsulation mode of the MAC address in the Calling-Station-Id attribute.
     • Run the radius-attribute nas-ip command to configure the NAS-IP-Address attribute in a RADIUS packet sent from an NAS.
     • Run the radius-server user-name domain-included command to configure whether the user name carried in the RADIUS packet contains a domain name.
  2. Run the radius-server authorization command in the system view to configure the authorization server to use the RADIUS server template server-group.
• After this function is configured, the priority of the NAS IP address in the NAS-IP-Address (4) attribute is as follows: NAS IP address configured in the RADIUS server template>source IP address configured on the accounting server>source IP address configured on the authentication server>destination IP address of the Request packet
• If the radius-server authorization attribute-encode-sameastemplate command is not configured, no RADIUS server template is bound to the authorization server, or no attribute format configuration exists in the RADIUS server template, the formats of COA or DM response packets are as follows:
  • MAC address in the Calling-Station-Id (31) attribute: The MAC address is encapsulated in the default format XXXXXXXXXXXX.
  • NAS IP address in the NAS-IP-Address (4) attribute: destination IP address in the Request packet
  • User name in the User-Name (1) attribute: The user name in the Request packet is used.

Usage Scenario

By default, the MAC address format in the calling-station-id attribute carried in RADIUS dynamic authorization packets is xxxxxxxxxxxx. If the MAC address format in the calling-station-id attribute sent by the RADIUS server is not the default format used on the device, run the radius-server authorization calling-station-id decode-mac-format command to change the MAC address format on the device.

When a device connects to multiple RADIUS servers, the RADIUS servers may send MAC addresses in different formats in the calling-station-id attribute to the device. You need to run the radius-server authorization attribute-decode-sameastemplate command to configure the device to parse the RADIUS authorization packet attributes based on the configuration in RADIUS server template, so that the device can work with these RADIUS servers.

Precautions

The configuration in a RADIUS server template has a higher priority than the global configuration.

Usage Scenario

Precautions

When the RADIUS attribute translation function is configured in the RADIUS template using the radius-attribute translate command, the match will fail.

Currently, the any method supports only the Acct-Session-ID (44), Calling-Station-Id (31), and Framed-IP-Address (8) attributes. The device does not match other attributes against user information on the device.

Usage Scenario

After the system starts, the RADIUS server status detection timer runs. The device sets the RADIUS server status to Up. When the device sends a RADIUS request packet to the RADIUS server, if the conditions for setting the RADIUS server status to Down are met, the device sets the RADIUS server status to Down; if the conditions are not met, the RADIUS server status remains to be Up.

If the device does not receive any response packet from the RADIUS server after sending the first RADIUS Access-Request packet to the server and the condition that the number of times the device does not receive any response packet from the server (n) is greater than or equal to the maximum number of consecutive unacknowledged packets (dead-count) is met in a detection interval, a communication interruption is recorded. If the device still does not receive any response packet from the RADIUS server, the device sets the RADIUS server status to Down when recording the communication interruption for the same times as the detection interval cycles.

Precautions

• If the device has reported a RADIUS server Up alarm and needs to report a RADIUS server Down alarm, the device will send the Down alarm 10 seconds after the Up alarm is sent, even if the RADIUS server Down detection interval is shorter than 10 seconds (for example, the value of dead-interval is set to 4 seconds, and the RADIUS server Down detection interval is 8 seconds). This function prevents frequent alarm sending.

• You are advised to set the RADIUS server detection interval, maximum number of consecutive unacknowledged packets in each detection interval, and number of times the detection interval cycles to be greater than the default values on the device to prevent the RADIUS server status from being set to Down.
• To check the RADIUS server status, run the display radius-server configuration command. If the RADIUS server status is Down, the device records logs and alarms. For details about logs, see RDS/4/RDAUTHDOWN. For details about alarms, see RDS_1.3.6.1.4.1.2011.5.25.40.15.2.2.1.2 hwRadiusAuthServerDown.

After the automatic detection function is enabled using the radius-server testuser command, you can run the radius-server detect-server interval command to adjust the automatic detection interval for RADIUS servers in Down status.

Usage Scenario

After the automatic detection function is enabled using the radius-server testuser command and the device sends detection packets to the RADIUS server, the device determines whether to switch the RADIUS server status based on whether it receives response packets from the RADIUS server within the timeout period. The following table lists the switchover conditions.

After the automatic detection function is enabled, automatic detection is classified into the following conditions depending on differences of the RADIUS server status.

Server Status	Whether Automatic Detection Is Supported	Time When an Automatic Detection Packet Is Sent	Condition for Switching the Server Status
Down	Automatic detection is supported by default.	An automatic detection packet is sent after the automatic detection period expires.	If the device receives a response packet from the RADIUS server within the timeout period for detection packets, the device marks the RADIUS server status as Up; otherwise, the RADIUS server status remains Down.
Up	Automatic detection can be enabled using the radius-server detect-server up-server interval command.	An automatic detection packet is sent after the automatic detection period expires.	If the conditions for marking the RADIUS server status as Down are met, the device marks the RADIUS server status as Down; otherwise, the RADIUS server status remains Up.
Force-up	Automatic detection is supported by default.	An automatic detection packet is sent immediately.	If the device receives a packet from the RADIUS server within the timeout period, the device marks the RADIUS server status as Up; otherwise, the device marks the RADIUS server status as Down.

On a large-scale network, you are advised not to enable automatic detection for RADIUS servers in Up state. This is because if automatic detection is enabled on multiple NAS devices, the RADIUS server periodically receives a large number of detection packets when processing RADIUS Access-Request packets source from users, which may deteriorate processing performance of the RADIUS server.

After the radius-server testuser command is configured, the dead-time timer configured using the radius-server dead-time command does not take effect.

Precautions

Usage Scenario

After automatic detection is enabled using the radius-server testuser command, the device automatically detects only RADIUS servers in Down status by default. To make the device automatically detect RADIUS servers in Up status, run the radius-server detect-server up-server interval command to enable automatic detection for RADIUS servers in Up status and configure the automatic detection interval.

Precautions

On a large-scale network, you are advised not to enable automatic detection for RADIUS servers in Up state. This is because if automatic detection is enabled on multiple NAS devices, the RADIUS server periodically receives a large number of detection packets when processing RADIUS Access-Request packets source from users, which may deteriorate processing performance of the RADIUS server.

The NAS port format affects the information about the physical port. The NAS port format can be used by the RADIUS server to process services, such as binding the user name and port. This attribute is developed by Huawei, which is used to ensure connectivity and service cooperation among Huawei devices.

If the radius-server nas-port-format command sets the format of the NAS-Port attribute to new (the default format is new), the device will check whether the radius-server format-attribute nas-port command configuration exists. If so, the device will assemble the NAS-Port attribute in the format configured by the radius-server format-attribute nas-port command. If no, the device will assemble the NAS-Port attribute in the new format. If the radius-server nas-port-format command sets the format of the NAS-Port attribute to old, the device will assemble the NAS-Port attribute in the old format, regardless of whether the radius-server format-attribute nas-port command configuration exists.

In MAC address authentication triggered through DHCP packets, a user can obtain an IP address only after being successfully authenticated. The RADIUS authentication request packet sent by the user does not carry the IP address of the user. By default, the device does not encapsulate the RADIUS attribute Framed-IP-Address into the RADIUS authentication request packet sent by the user when forwarding the packet. If the RADIUS server connected to the device requires that the received RADIUS authentication request packets contain the RADIUS attribute Framed-IP-Address, run the radius-server framed-ip-address no-user-ip enable command. Then the device uses the IP address 0.0.0.0 to encapsulate the RADIUS attribute Framed-IP-Address when receiving the RADIUS authentication request packets that do not contain the user IP address.

RADIUS is a fully extensible protocol. Device vendors can expand the No. 26 attribute defined in the protocol to implement functions not supported by standard RADIUS attributes. Huawei defines the No. 141 sub-attribute (HW-AP-Information) in the No. 26 attribute to indicate AP information, including the MAC and IP addresses of an AP. The HW-AP-Information attribute is carried in the authentication or accounting request packet send by a device, so that the RADIUS server can use the AP's MAC and IP addresses as the filter criterion to select a policy template to be delivered.

When an AP's IP address is carried in the HW-AP-Information attribute, the encapsulation format of the attribute is AP-MAC AP-IP.

Usage Scenario

If the user access frequency is low and the device receives only a few authentication request packets sourced from users, the device cannot detect the RADIUS server status by periodically detecting authentication request packets. In this case, you can configure the function of setting the RADIUS server status to Down if no response is received from the server for a long period of time to ensure that users can obtain escape authorization. When the interval between two consecutive unresponded authentication request packets is greater than the interval configured using the max-unresponsive-interval command, the RADIUS server is set to Down.

Precautions

To check the RADIUS server status, run the display radius-server configuration command. If the RADIUS server status is Down, the device records logs and alarms. For details about logs, see RDS/4/RDAUTHDOWN. For details about alarms, see RDS_1.3.6.1.4.1.2011.5.25.40.15.2.2.1.2 hwRadiusAuthServerDown.

A RADIUS server uses the NAS-Identifier attributes to identify NASs. The NASs also use the NAS-Identifier attributes carried in the sent RADIUS packets to identify themselves.

When the RADIUS server interconnected with the device requires that the NAS-Identifier attribute value is the MAC address of the AP when the device functions as an AC in a wireless scenario, you need to run the radius-server nas-identifier-format ap-info command.

Usage Scenario

The NAS port format affects the information about the physical port. The NAS port format can be used by the RADIUS server to process services, such as binding the user name and port. This attribute is developed by Huawei, which is used to ensure connectivity and service cooperation among Huawei devices.

Precautions

Usage Scenario

The NAS port format and the NAS port ID format are developed by Huawei, which are used to ensure connectivity and service cooperation among Huawei devices.

Precautions

Port of the NAS that is authenticating the user. The NAS-Port-Id attribute has the following formats:

• New:

  For Ethernet access users, the NAS-Port-Id is in the format "slot=xx; subslot=xx; port=xxx; vlanid=xxxx", in which "slot" is 64 or ranges from 0 to 15, "subslot" ranges from 0 to 15, "port" ranges from 0 to 255, "vlanid" ranges from 1 to 4094.

  For ADSL access users, the NAS-Port-Id is in the format "slot=xx; subslot=x; port=x; VPI=xxx; VCI=xxxxx", in which "slot" ranges from 0 to 15, "subslot" 0 to 9, "port" 0 to 9, "VPI" 0 to 255, and "VCI" 0 to 65535.

• Old:

  For Ethernet access users, the NAS-Port-Id is in the format "port number (2 characters) + sub-slot ID (2 bytes) + card number (3 bytes) + VLAN ID (9 characters)."

  For ADSL access users: port number (2 characters) + sub-slot ID (2 bytes) + card number (3 bytes) + VPI (8 characters) + VCI (16 characters). The fields are prefixed with 0s if they contain fewer bytes than specified.

If this attribute carries Chinese characters, it cannot be delivered using the radius-attribute set attribute-name attribute-value command.

Usage Scenario

The retransmission upon timeout mechanism is configured for a device to forward RADIUS Access-Request packets sourced from users to the server. The overall retransmission time depends on the retransmission interval, retransmission times, RADIUS server status, and number of servers configured in the RADIUS server template.

You can configure the number of times that RADIUS request packets are retransmitted and the timeout period using the radius-server retransmit retry-times and radius-server timeout time-value commands, respectively. If a device sends an authentication request packet to the RADIUS server and does not receive any response packet from the server during the timeout period, the device sends an authentication request packet again.

This command can improve the reliability of RADIUS authentication.

Precautions

• The request packet retransmission time (number of retransmission times x timeout period) of the RADIUS server must be shorter than the request packet retransmission time of the Portal server.
• If more than 8 authentication server IP addresses are configured in the RADIUS server template, reduce the number of retransmission times and timeout period.

Usage Scenario

You can run the radius-server dead-time dead-time command to configure the duration for which the RADIUS server remains Down. After the device sets the RADIUS server status to Down and the interval specified by dead-time expires, the device resets the server status to Force-up. Servers in Force-up and Up states have the same priority and participate in RADIUS server selection based on the algorithm specified by radius-server algorithm. If a new user needs to be authenticated in RADIUS mode and no RADIUS server is available, the device attempts to re-establish a connection with a RADIUS server in Force-up status. The Force-up status is defined to prevent servers in Down status from remaining idle.

After the radius-server testuser command is configured, the dead-time timer configured using the radius-server dead-time command does not take effect.

This command can improve the reliability of RADIUS authentication.

Usage Scenario

To improve device security, run this command to enable session management on the RADIUS server. After this function is enabled, the device checks the source IP addresses and shared keys for the received session management packets. When the source IP addresses and shared keys match the configured values, the packets are processed; otherwise, the packets are discarded.

Precautions

• When the any parameter is specified, there is a security risk. You are advised to configure the IP address and shared key for a specified RADIUS session management server.

• You also need to run the radius-server session-manage server-source command to configure an IPv4 address for receiving and responding to request packets of a RADIUS session management server so that the session management function of the RADIUS server can take effect.

Usage Scenario

By default, no IPv4 address can be used to receive or respond to request packets of a RADIUS session management server. When the device needs to establish a connection with a RADIUS session management server, you can run this command to specify an IPv4 address for receiving and responding to request packets of the RADIUS session management server.

Precautions

• After you run this command to configure an IPv4 address for the device to receive and respond to request packets of a RADIUS session management server, the RADIUS session management server can communicate with the device only through this IPv4 address. Ensure that the RADIUS session management server can communicate with the device through this IPv4 address at Layer 3.

• After the radius-server session-manage server-source all-interface command is run, the device receives and responds to request packets of a RADIUS session management through any IPv4 address, which increases system security risks. Therefore, you are advised not to run this command.

• After the radius-server session-manage server-source all-interface command is run, all the configurations of the radius-server session-manage server-source ip-address ip-address command are cleared.
• If the radius-server session-manage server-source all-interface command has been configured on the device, the radius-server session-manage server-source ip-address ip-address command configured later cannot be delivered.
• If the device is upgraded from a version earlier than and the session management function is enabled for the RADIUS server, the device delivers the radius-server session-manage server-source all-interface command by default to enable the session management function for the RADIUS server with an all-zero address.
• In versions earlier than , if the session management function of the RADIUS server is enabled, you need to enable the session management function when using the session management function of the RADIUS server in versions later than . That is, run the radius-server session-manage server-source all-interface command to enable the session management function of the RADIUS server with an all-zero IP address or run the radius-server session-manage server-source ip-address ip-address command to enable the session management function of the RADIUS server with a specified IP address.
• You also need to run the radius-server session-manage server-source command to configure an IPv4 address for receiving and responding to request packets of a RADIUS session management server so that the session management function of the RADIUS server can take effect.

Usage Scenario

The shared key is used to encrypt the password and generate the response authenticator.

When exchanging authentication packets with a RADIUS server, the device uses MD5 to encrypt important data such as the password to ensure security of data transmission over the network. To ensure validity of both communication parties, the device and RADIUS server must be configured with the same shared key.

Precautions

For security purposes, change the default shared key immediately. It is recommended that the new shared key contains at least two types of lower-case letters, upper-case letters, numerals, and special characters, and contains at least 8 characters.

During the configuration of this command, the weak password verification function is added to check whether a password is weak. If the password is weak, the command fails to be executed.