Table of Contents

Chapter 1 AAA_RADIUS_HWTACACS Configuration Commands. 1-1

1.1 AAA Configuration Commands. 1-1

1.1.1 access-limit 1-1

1.1.2 accounting. 1-2

1.1.3 accounting optional 1-3

1.1.4 authentication. 1-3

1.1.5 authentication super hwtacacs-scheme. 1-4

1.1.6 authorization. 1-5

1.1.7 display connection. 1-6

1.1.8 display domain. 1-7

1.1.9 display local-user 1-8

1.1.10 domain. 1-10

1.1.11 ip pool 1-11

1.1.12 level 1-12

1.1.13 local-user 1-13

1.1.14 local-user password-display-mode. 1-14

1.1.15 password. 1-15

1.1.16 scheme. 1-16

1.1.17 service-type. 1-17

1.1.18 service-type dvpn. 1-18

1.1.19 service-type ftp. 1-18

1.1.20 service-type ppp. 1-19

1.1.21 state. 1-19

1.1.22 super authentication-mode. 1-20

1.2 RADIUS Protocol Configuration Commands. 1-21

1.2.1 accounting optional 1-21

1.2.2 data-flow-format 1-22

1.2.3 debugging local-server 1-22

1.2.4 debugging radius. 1-23

1.2.5 display local-server statistics. 1-24

1.2.6 display radius scheme. 1-24

1.2.7 display radius statistics. 1-26

1.2.8 display stop-accounting-buffer 1-31

1.2.9 key. 1-32

1.2.10 local-server 1-33

1.2.11 nas-ip. 1-34

1.2.12 primary accounting. 1-34

1.2.13 primary authentication. 1-35

1.2.14 radius scheme. 1-36

1.2.15 radius nas-ip. 1-37

1.2.16 radius trap. 1-38

1.2.17 reset radius statistics. 1-39

1.2.18 reset stop-accounting-buffer 1-39

1.2.19 retry. 1-40

1.2.20 retry realtime-accounting. 1-41

1.2.21 retry stop-accounting. 1-42

1.2.22 secondary accounting. 1-43

1.2.23 secondary authentication. 1-44

1.2.24 server-type. 1-44

1.2.25 state. 1-45

1.2.26 stop-accounting-buffer enable. 1-46

1.2.27 timer quiet 1-47

1.2.28 timer realtime-accounting. 1-48

1.2.29 timer response-timeout 1-49

1.2.30 user-name-format 1-49

1.3 HWTACACS Configuration Commands. 1-50

1.3.1 data-flow-format 1-50

1.3.2 debugging hwtacacs. 1-51

1.3.3 display hwtacacs scheme. 1-52

1.3.4 display stop-accounting-buffer 1-54

1.3.5 hwtacacs nas-ip. 1-55

1.3.6 hwtacacs scheme. 1-56

1.3.7 key. 1-57

1.3.8 nas-ip. 1-57

1.3.9 primary accounting. 1-58

1.3.10 primary authentication. 1-59

1.3.11 primary authorization. 1-60

1.3.12 reset hwtacacs statistics. 1-61

1.3.13 reset stop-accounting-buffer 1-61

1.3.14 retry stop-accounting. 1-62

1.3.15 secondary accounting. 1-63

1.3.16 secondary authentication. 1-64

1.3.17 secondary authorization. 1-64

1.3.18 stop-accounting-buffer enable. 1-65

1.3.19 timer quiet 1-66

1.3.20 timer realtime-accounting. 1-67

1.3.21 timer response-timeout 1-68

1.3.22 user-name-format 1-68

Chapter 2 ACL Configuration Commands. 2-1

2.1 ACL Configuration Commands. 2-1

2.1.1 acl 2-1

2.1.2 description. 2-2

2.1.3 display acl 2-2

2.1.4 reset acl counter 2-3

2.1.5 rule. 2-3

2.1.6 rule comment 2-7

2.2 Time Range Configuration Commands. 2-8

2.2.1 display time-range. 2-8

2.2.2 time-range. 2-9

Chapter 3 NAT Configuration Commands. 3-1

3.1 NAT Configuration Commands. 3-1

3.1.1 connection-limit default 3-1

3.1.2 connection-limit default amount 3-1

3.1.3 connection-limit enable. 3-2

3.1.4 connection-limit policy. 3-3

3.1.5 debugging connection-limit 3-3

3.1.6 debugging nat 3-4

3.1.7 display connection-limit policy. 3-4

3.1.8 display connection-limit statistics. 3-5

3.1.9 display nat 3-6

3.1.10 display nat connection-limit 3-8

3.1.11 limit 3-9

3.1.12 nat address-group. 3-11

3.1.13 nat aging-time. 3-11

3.1.14 nat alg. 3-12

3.1.15 nat connection-limit-policy. 3-13

3.1.16 nat dns-map. 3-14

3.1.17 nat outbound. 3-15

3.1.18 nat outbound interface. 3-16

3.1.19 nat outbound static. 3-17

3.1.20 nat overlapaddress. 3-18

3.1.21 nat server 3-19

3.1.22 nat static. 3-22

3.1.23 nat static inside. 3-22

3.1.24 reset nat 3-23

Chapter 4 Firewall Configuration Commands. 4-1

4.1 Packet Filter Configuration Commands. 4-1

4.1.1 debugging firewall packet-filter 4-1

4.1.2 debugging firewall packet-filter fragments-inspect events. 4-2

4.1.3 display firewall fragment 4-2

4.1.4 display firewall packet-filter statistics. 4-3

4.1.5 firewall packet-filter default 4-3

4.1.6 firewall packet-filter enable. 4-4

4.1.7 firewall packet-filter fragments-inspect 4-4

4.1.8 firewall packet-filter fragments-inspect { high | low } 4-5

4.1.9 firewall packet-filter 4-6

4.1.10 reset firewall packet-filter statistics. 4-7

4.2 ASPF Configuration Commands. 4-8

4.2.1 aging-time. 4-8

4.2.2 aspf-policy. 4-9

4.2.3 debugging aspf 4-9

4.2.4 debugging aspf http. 4-10

4.2.5 detect 4-11

4.2.6 detect http. 4-12

4.2.7 display aspf all 4-13

4.2.8 display aspf interface. 4-14

4.2.9 display aspf policy. 4-15

4.2.10 display aspf session. 4-16

4.2.11 display aspf statistics. 4-17

4.2.12 display firewall fragment 4-18

4.2.13 display firewall session aging-time. 4-18

4.2.14 display firewall session table. 4-19

4.2.15 display port-mapping. 4-21

4.2.16 firewall aspf 4-21

4.2.17 firewall session aging-time. 4-22

4.2.18 firewall session aging-time default 4-23

4.2.19 log enable. 4-24

4.2.20 port-mapping. 4-24

4.2.21 reset aspf session. 4-25

4.2.22 reset aspf statistic http. 4-26

4.2.23 reset firewall session table. 4-26

4.3 VPN Instance Configuration Commands. 4-27

4.3.1 firewall session limit 4-27

4.3.2 firewall fragment limit 4-27

4.3.3 aspf session limit 4-28

4.4 Blacklist Configuration Commands. 4-29

4.4.1 debugging firewall blacklist 4-29

4.4.2 display firewall blacklist 4-29

4.4.3 firewall blacklist 4-30

4.5 MAC and IP Address Binding Configuration Commands. 4-31

4.5.1 debugging firewall mac-binding. 4-31

4.5.2 display firewall mac-binding. 4-32

4.5.3 firewall mac-binding. 4-33

4.5.4 firewall mac-binding enable. 4-33

4.5.5 reset firewall mac-binding. 4-34

4.6 Security Zone Configuration Commands. 4-35

4.6.1 add interface. 4-35

4.6.2 display interzone. 4-35

4.6.3 display zone. 4-36

4.6.4 set priority. 4-37

4.6.5 firewall interzone. 4-37

4.6.6 firewall zone. 4-38

4.6.7 firewall zone name. 4-38

Chapter 5 Transparent Firewall Configuration Commands. 5-1

5.1 Transparent Firewall Configuration Commands. 5-1

5.1.1 acl number 5-1

5.1.2 bridge vlanid-transparent-transmit enable. 5-1

5.1.3 debugging firewall eff 5-3

5.1.4 debugging firewall transparent-mode eth-forwarding. 5-4

5.1.5 debugging firewall transparent-mode ip-forwarding. 5-6

5.1.6 display firewall ethernet-frame-filter 5-7

5.1.7 display firewall mode. 5-8

5.1.8 display firewall transparent-mode address-table. 5-9

5.1.9 display firewall transparent-mode config. 5-10

5.1.10 display firewall transparent-mode traffic. 5-10

5.1.11 firewall arp-learning enable. 5-13

5.1.12 firewall ethernet-frame-filter 5-13

5.1.13 firewall mode. 5-14

5.1.14 firewall system-ip. 5-15

5.1.15 firewall transparent-mode aging-time. 5-16

5.1.16 firewall transparent-mode transmit 5-16

5.1.17 firewall unknown-mac. 5-17

5.1.18 firewall unknown-mac broadcast 5-18

5.1.19 firewall unknown-mac multicast 5-18

5.1.20 firewall unknown-mac unicast 5-19

5.1.21 reset firewall ethernet-frame-filter 5-20

5.1.22 reset firewall transparent-mode address-table. 5-20

5.1.23 reset firewall transparent-mode traffic. 5-21

5.1.24 rule. 5-21

Chapter 6 Web and E-mail Filtering Configuration Commands. 6-1

6.1 Web Filtering Configuration Commands. 6-1

6.1.1 debugging firewall url-filter host 6-1

6.1.2 debugging firewall url-filter parameter 6-1

6.1.3 debugging firewall webdata-filter 6-2

6.1.4 display firewall url-filter host 6-3

6.1.5 display firewall url-filter parameter 6-4

6.1.6 display firewall url-filter parameter counter detail 6-4

6.1.7 display firewall webdata-filter 6-5

6.1.8 firewall url-filter host acl-number 6-6

6.1.9 firewall url-filter host add. 6-6

6.1.10 firewall url-filter host clear 6-7

6.1.11 firewall url-filter host default 6-8

6.1.12 firewall url-filter host delete. 6-8

6.1.13 firewall url-filter host enable. 6-9

6.1.14 firewall url-filter host ip-address. 6-9

6.1.15 firewall url-filter host save-file. 6-10

6.1.16 firewall url-filter load-file. 6-10

6.1.17 firewall url-filter parameter add. 6-11

6.1.18 firewall url-filter parameter add-default 6-12

6.1.19 firewall url-filter parameter clear 6-13

6.1.20 firewall url-filter parameter delete. 6-13

6.1.21 firewall url-filter parameter enable. 6-13

6.1.22 firewall url-filter parameter load-file. 6-14

6.1.23 firewall url-filter parameter save-file. 6-15

6.1.24 firewall webdata-filter add. 6-15

6.1.25 firewall webdata-filter clear 6-16

6.1.26 firewall webdata-filter delete. 6-17

6.1.27 firewall webdata-filter enable. 6-17

6.1.28 firewall webdata-filter load-file. 6-18

6.1.29 firewall webdata-filter save-file. 6-19

6.1.30 reset firewall url-filter host counter 6-19

6.1.31 reset firewall url-filter parameter counter 6-19

6.1.32 reset firewall webdata-filter counter 6-20

6.2 E-mail Filtering Configuration Commands. 6-20

6.2.1 debugging firewall smtp-filter 6-20

6.2.2 display firewall smtp-filter 6-21

6.2.3 firewall smtp-filter attach add. 6-22

6.2.4 firewall smtp-filter attach clear 6-23

6.2.5 firewall smtp-filter attach delete. 6-23

6.2.6 firewall smtp-filter attach enable. 6-24

6.2.7 firewall smtp-filter attach load-file. 6-24

6.2.8 firewall smtp-filter attach save-file. 6-25

6.2.9 firewall smtp-filter content add. 6-26

6.2.10 firewall smtp-filter content clear 6-26

6.2.11 firewall smtp-filter content delete. 6-27

6.2.12 firewall smtp-filter content enable. 6-27

6.2.13 firewall smtp-filter content load-file. 6-28

6.2.14 firewall smtp-filter content save-file. 6-28

6.2.15 firewall smtp-filter rcptto add. 6-29

6.2.16 firewall smtp-filter rcptto clear 6-30

6.2.17 firewall smtp-filter rcptto default 6-30

6.2.18 firewall smtp-filter rcptto delete. 6-31

6.2.19 firewall smtp-filter rcptto enable. 6-31

6.2.20 firewall smtp-filter rcptto load-file. 6-32

6.2.21 firewall smtp-filter rcptto save-file. 6-33

6.2.22 firewall smtp-filter subject add. 6-33

6.2.23 firewall smtp-filter subject clear 6-34

6.2.24 firewall smtp-filter subject delete. 6-34

6.2.25 firewall smtp-filter subject enable. 6-35

6.2.26 firewall smtp-filter subject load-file. 6-35

6.2.27 firewall smtp-filter subject save-file. 6-36

6.2.28 reset firewall smtp-filter counter 6-36

Chapter 7 Attack Defense Configuration Commands. 7-1

7.1 Attack Defense Configuration Commands. 7-1

7.1.1 debugging firewall defend. 7-1

7.1.2 display firewall defend flag. 7-2

7.1.3 display firewall tcp-proxy session. 7-2

7.1.4 firewall defend all 7-4

7.1.5 firewall defend arp-flood. 7-5

7.1.6 firewall defend arp-spoofing. 7-5

7.1.7 firewall defend fraggle. 7-6

7.1.8 firewall defend frag-flood. 7-7

7.1.9 firewall defend icmp-flood. 7-7

7.1.10 firewall defend icmp-flood enable. 7-9

7.1.11 firewall defend icmp-redirect 7-9

7.1.12 firewall defend icmp-unreachable. 7-10

7.1.13 firewall defend ip-fragment 7-10

7.1.14 firewall defend ip-spoofing. 7-11

7.1.15 firewall defend ip-sweep. 7-12

7.1.16 firewall defend land. 7-12

7.1.17 firewall defend large-icmp. 7-13

7.1.18 firewall defend ping-of-death. 7-14

7.1.19 firewall defend port-scan. 7-14

7.1.20 firewall defend route-record. 7-15

7.1.21 firewall defend smurf 7-16

7.1.22 firewall defend source-route. 7-16

7.1.23 firewall defend syn-flood. 7-17

7.1.24 firewall defend syn-flood enable. 7-18

7.1.25 firewall defend tcp-flag. 7-19

7.1.26 firewall defend teardrop. 7-19

7.1.27 firewall defend tracert 7-20

7.1.28 firewall defend udp-flood. 7-20

7.1.29 firewall defend udp-flood enable. 7-21

7.1.30 firewall defend winnuke. 7-22

7.1.31 firewall tcp-proxy. 7-23

Chapter 8 IDS Cooperation Configuration Commands. 8-1

8.1 IDS Cooperation Configuration Commands. 8-1

8.1.1 ids-acl enable. 8-1

8.1.2 display ids. 8-1

8.1.3 display ids-acl 8-3

8.1.4 debugging ids. 8-3

Chapter 9 Packet Statistics and Log Configuration Commands. 9-1

9.1 Packet Statistics Configuration Commands. 9-1

9.1.1 display firewall statistic. 9-1

9.1.2 display firewall statistic system defend. 9-3

9.1.3 display firewall statistic system flow-percent 9-4

9.1.4 firewall statistic system connect-number 9-5

9.1.5 firewall statistic system enable. 9-6

9.1.6 firewall statistic system flow-percent 9-7

9.1.7 firewall statistic warning-level drop. 9-8

9.1.8 reset firewall statistic ip. 9-9

9.1.9 reset firewall statistic system.. 9-9

9.1.10 reset firewall statistic zone. 9-10

9.1.11 statistic connect-number ip. 9-10

9.1.12 statistic connect-number zone. 9-12

9.1.13 statistic connect-speed ip. 9-13

9.1.14 statistic connect-speed zone. 9-14

9.1.15 statistic enable. 9-15

9.2 SMTP Client Configuration Commands. 9-16

9.2.1 debugging smtpc. 9-16

9.2.2 display smtpc. 9-16

9.2.3 smtpc administrator mail 9-17

9.2.4 smtpc trigger time. 9-17

9.3 DNSC Configuration Commands. 9-18

9.3.1 debugging dnsc. 9-18

9.3.2 display dnsc. 9-19

9.3.3 dnsc server 9-19

9.3.4 dnsc cache. 9-20

9.4 Log Configuration Commands. 9-21

9.4.1 firewall session log-type. 9-21

9.4.2 firewall log-time. 9-21

9.4.3 reset firewall log-buf 9-22

 

Chapter 1  AAA_RADIUS_HWTACACS Configuration Commands

 

 

1.1  AAA Configuration Commands

1.1.1  access-limit

Syntax

access-limit { disable | enable max-user-number }

undo access-limit

View

ISP domain view

Parameters

disable: Specifies not to limit the number of supplicants that the current ISP domain can accommodate.

enable max-user-number: Specifies the maximum number of supplicants that the current ISP domain can accommodate. max-user-number is in the range of 1 to 1048.

Description

Use the access-limit command to specify the maximum number of supplicants that the current ISP domain can accommodate.

Use the undo access-limit command to restore the default.

By default, there is no limit to the amount of supplicants in the current ISP domain.

An appropriate setting can bring in reliable performances for users in the current ISP domain for resource contention.

Examples

# Set a limit of 500 supplicants for the ISP domain test163.net.

[SecBlade_FW-isp-test163.net] access-limit enable 500

1.1.2  accounting

Syntax

accounting { hwtacacs-scheme hwtacacs-scheme-name | radius-scheme radius-scheme-name | none }

undo accounting

View

ISP domain view

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies to use the HWTACACS scheme for accounting.

radius-scheme radius-scheme-name: Specifies to use the RADIUS scheme for accounting.

none: Specifies no accounting scheme.

Description

Use the accounting command to configure an accounting scheme for the current ISP domain.

Use the undo accounting command to remove the configuration.

By default, no accounting scheme is configured.

The RADIUS or HWTACACS scheme which is specified by the accounting command for the current ISP domain must have been configured already.

If you configure the accounting command in domain view, the accounting scheme specified by this command will be adopted. Otherwise, the accounting scheme specified by the scheme command is adopted.

Related commands: scheme, radius scheme, hwtacacs scheme.

Examples

# Configure to use the RADIUS accounting scheme radius in the current ISP domain h3c163.net.

[SecBlade_FW-isp-h3c163.net] accounting radius-scheme radius

# Configure to use the HWTACACS accounting scheme radius in the current ISP domain h3c.

[SecBlade_FW-isp-h3c] accounting hwtacacs-scheme hwtac

1.1.3  accounting optional

Syntax

accounting optional

undo accounting optional

View

ISP domain view

Parameters

None

Description

Use the accounting optional command to enable optional accounting.

Use the undo accounting optional command to disable optional accounting.

By default, optional accounting is disabled.

With the accounting optional command, a user that will be disconnected otherwise can use network resources even when there is no available accounting server or the communication with the current accounting server fails. This command is normally used for authentication without accounting.

Examples

# Enable optional accounting for users in the domain test163.net.

[SecBlade_FW] domain test163.net

[SecBlade_FW-isp-test163.net] accounting optional

1.1.4  authentication

Syntax

authentication { hwtacacs-scheme hwtacacs-scheme-name [ local ] | radius-scheme radius-scheme-name [ local ] | local | none }

undo authentication

View

ISP domain view

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies to use the HWTACACS scheme for authentication.

radius-scheme radius-scheme-name: Specifies to use the RADIUS scheme for authentication.

local: Specifies to use the local authentication scheme for authentication.

none: Specifies no authentication scheme.

Description

Use the authentication command to configure an authentication scheme for the current ISP domain.

Use the undo authentication command to restore the default.

By default, the local authentication scheme is adopted.

The RADIUS or HWTACACS scheme which is specified by the authentication command for the current ISP domain must have been configured already.

When the authentication radius-scheme radius-scheme-name local command or the authentication hwtacacs-scheme hwtacacs-scheme-name local command is configured, the local authentication scheme applies as a backup scheme in case the RADIUS or TACACS server is not available. If the RADIUS or TACACS server is available, local authentication is not used.

If the local or none scheme applies as the first scheme, no RADIUS or HWTACACS scheme can be adopted.

If you configure the authentication command in domain view, the authentication scheme specified by this command will be adopted. Otherwise, the authentication scheme specified by the scheme command is adopted.

Related commands: scheme, radius scheme, hwtacacs scheme.

Examples

# Specify to adopt the RADIUS authentication scheme radius in the current ISP domain h3c163.net.

[SecBlade_FW-h3c163.net] authentication radius-scheme  radius

# Specify to adopt the RADIUS authentication scheme rd and the local scheme to be the backup scheme in the ISP domain h3c.

[SecBlade_FW-isp-h3c] authentication radius-scheme rd local

# Specify to adopt the HWTACACS authentication scheme hwtac and the local scheme to be the backup scheme in the ISP domain h3c.

[SecBlade_FW-isp-h3c] authentication hwtacacs-scheme hwtac local

1.1.5  authentication super hwtacacs-scheme

Syntax

authentication super hwtacacs-scheme hwtacacs-scheme-name

undo authentication super hwtacacs-scheme

View

ISP domain view

Parameters

hwtacacs-scheme-name: Name of the HWTACACS scheme adopted for authentication.

Description

Use the authentication super hwtacacs-scheme command to configure a super authentication scheme for an ISP domain.

Use the undo authentication super hwtacacs-scheme command to remove the configuration.

By default, no super authentication scheme is configured.

Examples

# Configure the super authentication scheme of the system domain as sup.

[SecBlade_FW] domain system

[SecBlade_FW-isp-system] authentication super hwtacacs-scheme sup

1.1.6  authorization

Syntax

authorization { hwtacacs-scheme hwtacacs-scheme-name | none }

undo authorization

View

ISP domain view

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Specifies to use the HWTACACS scheme for authorization.

none: Specifies no authorization scheme.

Description

Use the authorization command to configure an authorization scheme for the current ISP domain.

Use the undo authorization command to restore the default.

By default, the local authorization scheme is adopted.

The RADIUS or HWTACACS scheme which is specified by the authorization command for the current ISP domain must have been configured already.

If you configure the authorization command in domain view, the authorization scheme specified by this command will be adopted. Otherwise, the authorization scheme specified by the scheme command is adopted.

Related commands: scheme, radius scheme, hwtacacs scheme.

Examples

# Configure to adopt the HWTACACS authorization scheme hwtac in the ISP domain h3c.

[SecBlade_FW-isp-h3c] authorization hwtacacs-scheme hwtac

1.1.7  display connection

Syntax

display connection [ domain isp-name ip ip-address | mac mac-address | radius-scheme radius-scheme-name | hwtacacs-scheme hwtacacs-scheme-name | ucibindex ucib-index | user-name user-name ]

View

Any view

Parameters

domain isp-name: Displays all the user connections associated with the ISP domain specified by isp-name, a string of up to 24 characters. The specified ISP domain must an existing one.

ip ip-address: Displays all the user connections associated with the specified IP address.

mac mac-address: Displays all the user connections associated with the specified hexadecimal MAC address in the format of x-x-x.

radius-scheme radius-scheme-name: Displays all the user connections associated with the RADIUS scheme specified by radius-scheme-name, a string of up to 32 characters.

hwtacacs-scheme hwtacacs-scheme-name: Displays all the user connections associated with the HWTACACS scheme specified by hwtacacs-scheme-name, a string of up to 32 characters.

ucibindex ucib-index: Displays the information of the connection index number specified by ucib-index. ucib-index is in the range of 0 to 7,071.

user-name user-name: Displays the connection information of the specified user name. User name is in the format of pure-username@domain. pure-username is the pure user name composed of up to 55 characters and domain is the domain name consisting of up to 24 characters.

Description

Use the display connection command to view information about the specified user connection or all the connections. The output can help you troubleshoot user connections.

By default, information about all user connections is displayed.

Examples

# Display information about all user connections associated with the domain system.

<SecBlade_FW> display connection domain system

Index=0   ,Username=hfx@system

 IP=188.188.188.3

 

 Total 1 connections matched, 1 listed.

Table 1-1 Description on the fields of the display connection command

Field	Description
Index	Connection index number
Username	User name
IP	IP address of the user

 

1.1.8  display domain

Syntax

display domain [ isp-name ]

View

Any view

Parameters

isp-name: Name of the ISP domain, a string of 1 to 24 characters. The specified ISP domain must be an existing one.

Description

Use the display domain command to view the configuration of the specified ISP domain or display the summary information of all ISP domains.

If the domain name is not specified, the summary information of all ISP domains is displayed.

The output information is helpful for troubleshooting ISP domain.

Related commands: access-limit, domain, scheme, state, display domain.

Examples

# Display the summary information of all ISP domains.

<SecBlade_FW> display domain

0  Domain = system

   State = Active

   Scheme = LOCAL

   Access-limit = Disable

   Domain User Template:

 

Default Domain Name: system

Total 1 domain(s).1 listed.

Table 1-2 Description on the fields of the display domain command

Field	Description
Domain	Domain name and sequence number
State	State of users in the domain (active or block)
Scheme	Authentication scheme for users in the domain (local or RADIUS or TACACS)
Access-limit	Whether to limit the number of users the domain can accommodate (disable or enable)

 

1.1.9  display local-user

Syntax

display local-user [ domain isp-name | service-type { telnet | ssh | terminal | dvpn | ftp | ppp } | state { active | block } | user-name user-name ]

View

Any view

Parameters

domain isp-name: Displays all the local users in the ISP domain specified by isp-name, a string of up to 24 characters. The specified ISP domain must be an existing one.

service-type: Displays local users by specifying service type, which can be telnet for Telnet users, ssh for SSH users, terminal for terminal users logging in through the Console or AUX port, ftp for FTP users, ppp for PPP users, or dvpn for DVPN users.

state { active | block }: Displays local users by specifying user state, where active represents users allowed to request for network services and block represents the opposite.

user-name user-name: Displays a local user by specifying its user-name, a string of 1 to 80 characters. It must exclude forward slashes (/), colons (:), asterisks (*), question marks (?), less-than signs (<), and greater-than signs (>). The @ sign can be present once in a user name. The user name without domain name (the part before @, namely the user ID) cannot exceed 55 characters.

Description

Use the display local-user command to view the relevant information on the specified local user or all the local users. The output can help you troubleshoot faults related to local users.

By default, information on all local users is displayed.

Related commands: local-user.

Examples

# Display the information of all local users.

<SecBlade_FW> display local-user

The contents of local user admin:

 State:          Active            ServiceType Mask: T

 Idle-cut:       Disable

 Access-limit:   Disable           Current AccessNum: 0

 Bind location:  Disable

 Vlan ID:        Disable

 IP address:     Disable

 MAC address:    Disable

 User Privilege: 3

The contents of local user ftpuser:

 State:          Active            ServiceType Mask: F

 Idle-cut:       Disable

 Access-limit:   Disable           Current AccessNum: 0

 Bind location:  Disable

 Vlan ID:        Disable

 IP address:     Disable

 MAC address:    Disable

 FTP Directory:  flash:

Total 2 local user(s) Matched, 2 listed.

ServiceType Mask Meaning: A--PAD  C--Terminal  D--DVPN  F--FTP  P--PPP  S--SSH

T—Telnet

Table 1-3 Description on the fields of the display local-user command

Field	Description
State	User state (active or block)
ServiceType Mask	Abbreviation for service type
Idle-cut	Idle-cut switch
Access-Limit	Limit of user connections
Current AccessNum	Number of the access users
Bind location	Whether it is bound with the port
VLAN ID	VLAN for the user
IP address	IP address of the user
MAC address	MAC address of the user
FTP Directory	Directory authorized to FTP users
User Privilege	User level

 

1.1.10  domain

Syntax

domain [ isp-name | default { disable | enable isp-name } ]

undo domain isp-name

View

System view

Parameters

isp-name: Name of the ISP domain, a string of 1 to 24 characters, excluding forward slashes (/), colons (:), asterisks (*), question marks (?), less-than signs (<), and greater-than signs (>).

default: Configures the default ISP domain. The default ISP domain is system. You can configure a default ISP domain manually.

disable: Disables the configured default ISP domain. It results in refusal of the usernames without domain names. If you configure to send user names without domain names to RADIUS servers, these user names will not be rejected.

enable: Enables the configured default ISP domain. It is to be appended to usernames without domain names before they are sent to the intended RADIUS servers. If you configure to send user names without domain names to RADIUS servers, these user names will not be appended with the default domain name.

Description

Use the domain command to configure an ISP domain or enter the view of an existing ISP domain.

Use the undo domain command to remove the specified ISP domain.

By default, the system uses the domain named system. You cannot delete it, but you are allowed to modify its configuration. In addition, you can view its settings using the display domain command.

An ISP domain is a group of users belonging to the same ISP. Generally, for a username in the userid@isp-name format, [email protected] for example, the isp-name (”test163.net” in the example) following the “@” is the ISP domain name. When an AAA server controls user access, for an ISP user whose username is in userid@isp-name format, the system takes the part "userid" as username for identification and takes the part "isp-name" as domain name.

The purpose of introducing ISP domain settings is to support the application environment with several ISP domains. In this case, an access device may have supplicants from different ISP domains. Because the attributes of ISP users, such as username and password structures, service types, may be different, it is necessary to separate them by setting ISP domains. In ISP domain view, you can configure a complete set of ISP domain attributes for each ISP domain, including an AAA scheme (the RADIUS scheme applied).

For a SecBlade, each supplicant belongs to an ISP domain. The system supports up to 16 ISP domains.

When this command is used, if the specified ISP domain does not exist, the system will create a new ISP domain. All the ISP domains are in the active state after they are created.

Related commands: access-limit, scheme, state, and display domain.

Examples

# Create a new ISP domain named test163.net and enters its view.

[SecBlade_FW] domain test163.net

New Domain added.

[SecBlade_FW-isp-test163.net]

1.1.11  ip pool

Syntax

ip pool pool-number low-ip-address [ high-ip-address ]

undo ip pool pool-number

View

System view, ISP domain view

Parameters

pool-number: Address pool number, ranging from 0 to 99.

low-ip-address and high-ip-address: The start and end IP addresses of the address pool. The number of in-between addresses cannot exceed 1024. If the end IP address is not specified, there will be only one IP address in the pool, namely the start IP address.

Description

Use the ip pool command to configure a local address pool for assigning IP addresses to PPP users.

Use the undo ip pool command to delete the specified local address pool.

By default, no local IP address pool is configured.

You can configure an IP address pool in system view and use the remote address command in interface view to assign IP addresses from the pool to PPP users.

You can also configure an IP address pool in ISP domain view for assigning IP addresses to PPP users in the current ISP domain. This applies to the case where an interface serves a great amount of PPP users but has inadequate address resources for allocation. For example, an Ethernet interface running PPPoE can accommodate 4095 users at most. However, only one address pool with up to 1024 addresses can be configured on its Virtual Template (VT). This is obviously far from what is required. To address the issue, you can configure address pools for ISP domains and assign addresses from them to PPP users.

Related commands: remote address.

Examples

# Configure the local IP address pool 0 in the range of 129.102.0.1 to 129.102.0.10.

[SecBlade_FW] domain test163.net

[SecBlade_FW-isp-test163.net] ip pool 0 129.102.0.1 129.102.0.10

1.1.12  level

Syntax

level level

undo level

View

Local user view

Parameters

level: Privilege level of the specified user, an integer ranging from 0 to 3.

Description

Use the level command to configure a privilege level for a user.

Use the undo level command to restore the default privilege level.

By default, the privilege level of a user is 0.

Related commands: local user.

 

 

Examples

# Set the privilege level of the test user to 3.

[SecBlade_FW-luser-test] level 3

1.1.13  local-user

Syntax

local-user user-name

undo local-user user-name [ service-type | level ]

undo local-user all [ service-type { ftp | ppp | ssh | telnet | terminal } ]

View

System view

Parameters

user-name: Name of a local user, a string of up to 80 characters, excluding forward slashes (/), colons (:), asterisks (*), question marks (?), less-than signs (<), and greater-than signs (>). The @ sign can be used only once in one username. The username without domain name (the part before @, namely the user ID) cannot exceed 55 characters. user-name is case-insensitive, so UserA and usera are the same.

service-type: Service type.

all: All the users.

ftp: FTP service type.

ppp: PPP service type.

ssh: SSH service type.

telnet: Telnet service type.

terminal: Terminal service type.

Description

Use the local-user command to add a local user and enter the local user view.

Use the undo local-user user-name command to remove the specified local user or the related attributes of the specified local user.

Use the undo local-user all command to remove all local users or local users of a specified service type.

By default, no local user is configured.

Related commands: display local-user.

Examples

# Add a local user named test1.

[SecBlade_FW] local-user test1

[SecBlade_FW-luser-test1]

1.1.14  local-user password-display-mode

Syntax

local-user password-display-mode { cipher-force | auto }

undo local-user password-display-mode

View

System view

Parameters

cipher-force: Specifies to display the passwords of all the accessed users in cipher text.

auto: Specifies that a user can use the password command to set a password display mode.

Description

Use the local-user password-display-mode command to configure the password display mode for all the local users.

Use the undo local-user password-display-mode command to restore the default.

If you uses the password command and specifies to display passwords in simple text (the simple mode) before the cipher-force mode applies, the former does not take effect.

By default, auto applies.

Related commands: display local-user and password.

Examples

# Display the passwords of all local users in cipher text.

[SecBlade_FW] local-user password-display-mode cipher-force

1.1.15  password

Syntax

password { simple | cipher } password

undo password

View

Local user view

Parameters

simple: Specifies to display passwords in simple text.

cipher: Specifies to display passwords in cipher text.

password: Defines a password. For the simple keyword, the password is a string of 1 to 16 characters in simple text; for the cipher keyword, the password can be a string of 1 to 16 characters in simple text, 1234567 for example, or a string of 24 characters in cipher text, (TT8F]Y\5SQ=^Q`MAF4<1!! for example.

Description

Use the password command to configure a password for a local user.

Use the undo password command to remove the configuration

If you uses the password command and specifies to display passwords in simple text (the simple mode) before the local-user password-display-mode cipher-force command applies, the former does not take effect.

Related commands: display local-user.

Examples

# Display the password of the user test1 in simple text, with the password being 20030422.

[SecBlade_FW-luser-test1] password simple 20030422

1.1.16  scheme

Syntax

scheme { radius-scheme radius-scheme-name [ local ] | hwtacacs-scheme hwtacacs-scheme-name [ local ] | local | none }

undo scheme [ radius-scheme | hwtacacs-scheme | none ]

View

ISP domain view

Parameters

radius-scheme-name: Name of the RADIUS scheme, a string of 1 to 32 characters.

hwtacacs-scheme-name: Name of the HWTACACS scheme, a string of 1 to 32 characters.

local: Specifies to use local AAA scheme.

none: Specifies no AAA scheme.

Description

Use the scheme command to configure an AAA scheme for the current ISP domain.

Use the undo scheme command to restore the default AAA scheme.

The default AAA scheme in the system is local.

The RADIUS or HWTACACS scheme specified by the command for the current ISP domain use must be exist.

When the radius-scheme radius-scheme-name local command or the hwtacacs-scheme hwtacacs-scheme-name local command is configured, the local scheme applies as a backup scheme if the RADIUS or TACACS server is not available. If the RADIUS or TACACS server is available, local authentication is not used.

If the local scheme applies as the first scheme, only the local AAA scheme is adopted, and no RADIUS or HWTACACS scheme can be adopted.

If the none scheme applies as the first scheme, no AAA scheme is adopted, and no RADIUS or HWTACACS scheme can be adopted.

The none authentication mode is not applicable for authenticating FTP users because the CMW-enabled FTP server does not support anonymous login.

If the scheme none command is used, the privilege of a user is level 0 after login.

Related commands: radius scheme and hwtacacs scheme.

Examples

# Specify the current ISP domain, test163.net, to use the RADIUS scheme Test.

[SecBlade_FW-isp-test163.net] scheme radius Test

# Set the ISP domain to use the RADIUS scheme rd and use local scheme as backup scheme.

[SecBlade_FW-isp-test] scheme radius-scheme rd local  

# Set the ISP domain to use the HWTACACS scheme hwtac and use local scheme as backup scheme.

[SecBlade_FW-isp-test] scheme hwtacacs-scheme hwtac local

1.1.17  service-type

Syntax

service-type { telnet | ssh | terminal }* [ level level ]

undo service-type { telnet | ssh | terminal }*

View

Local user view

Parameters

telnet: Authorizes the user to use Telnet service.

ssh: Authorizes the user to use SSH service.

terminal: Authorizes the user to use terminal service (that is, the user logs in through the Console, or AUX port).

level level: Specifies user privilege level. level is an integer in the range of 0 to 3.

Description

Use the service-type command to configure one or more service types for a user.

Use the undo service-type command to delete one or all service types configured for the user.

By default, no service is available for the user.

Related commands: service-type ppp and service-type ftp.

Examples

# Authorize the user to use Telnet service.

[SecBlade_FW-luser-test1] service-type telnet

1.1.18  service-type dvpn

Syntax

service-type dvpn

undo service-type dvpn

View

Local user view

Parameters

None

Description

Use the service-type dvpn command to authorize a user to use DVPN service.

Use the undo service-type dvpn command to cancel the authorization.

By default, DVPN service is not authorized to the user.

Examples

# Authorize the user to use DVPN service.

[SecBlade_FW-luser-test1] service-type dvpn

1.1.19  service-type ftp

Syntax

service-type ftp [ ftp-directory directory]

undo service-type ftp [ ftp-directory ]

View

Local user view

Parameters

ftp-directory directory: Specifies a directory accessible for the FTP user.

Description

Use the service-type ftp command to authorize a user to use FTP service and specify a directory accessible for the FTP user.

Use the undo service-type ftp command to cancel the authorization and restore the default directory accessible for the FTP user.

By default, no FTP services are authorized and access in anonymous mode is prohibited for FTP users. If a user is authorized to use FTP service, the user by default can access the root directory flash:/.

Examples

# Authorize the user to use FTP service.

[SecBlade_FW-luser-test1] service-type ftp

1.1.20  service-type ppp

Syntax

service-type ppp

undo service-type ppp

View

Local user view

Parameters

None

Description

Use the service-type ppp command to authorize a user to use PPP service.

Use the undo service-type ppp command to cancel the authorization.

By default, no PPP services are authorized to the user.

Examples

# Authorize the user to use PPP service.

[SecBlade_FW-luser-test1] service-type ppp

1.1.21  state

Syntax

state { active | block }

View

ISP domain view, local user view

Parameters

active: Specifies the current ISP domain (ISP domain view) or the current local user (local user view) in active state, that is, allows users in the current ISP domain or the current local user to request network services.

block: Specifies the current ISP domain (ISP domain view) or the current local user (local user view) in block state, that is, prohibits users in the current ISP domain or the current local user to request network services.

Description

Use the state command to configure the state of the current ISP domain or the current local user.

By default, an ISP domain (in ISP domain view) and a local user (in local user view) are in active state upon their creation.

Every ISP domain can be active or block in ISP domain view. If an ISP domain is configured to be active, users in the ISP domain can request network services; whereas in the block state, users in the ISP domain are prohibited to request network services, which does not affect the currently online users. This also applies to local users.

Related commands: domain.

Examples

# Set the state of the current ISP domain test163.net to block. The supplicants in this domain cannot request network services.

[SecBlade_FW-isp-test163.net] state block

# Set the state of the user test1 to block.

[SecBlade_FW-luser-test1] state block

1.1.22  super authentication-mode

Syntax

super authentication-mode { super-password | scheme }*

undo super authentication-mode

View

User interface view

Parameters

super-password: Specifies to use a super password for authentication.

scheme: Specifies to use a user configured scheme for authentication.

Description

Use the super authentication-mode command to configure the super authentication mode.

Use the undo super authentication-mode command to restore the default.

By default, the super-password authentication mode is adopted.

Examples

# Configure the scheme authentication mode for a user who logs in through the console port.

<SecBlade_FW> system-view

[SecBlade_FW] user-interface console 0

[SecBlade_FW-ui-con0] super authentication-mode scheme

1.2  RADIUS Protocol Configuration Commands

1.2.1  accounting optional

Syntax

accounting optional

undo accounting optional

View

RADIUS domain view

Parameters

None

Description

Use the accounting optional command to enable optional accounting.

Use the undo accounting optional command to disable it.

By default, the optional accounting is disabled.

With the accounting optional command, a user that will be disconnected otherwise can use network resources even when there is no available accounting server or the communication with the current accounting server fails. This command is normally used for authentication without accounting.

Examples

# Enable the optional accounting of the RADIUS scheme test.

[SecBlade_FW-radius-test] accounting optional

1.2.2  data-flow-format

Syntax

data-flow-format data { byte | giga-byte | kilo-byte | mega-byte } packet { giga-packet | kilo-packet | mega-packet | one-packet }

undo data-flow-format

View

RADIUS view

Parameters

data: Specifies the unit for data flows, which can be byte, gigabyte, kilobyte, or megabyte.

packet: Specifies the unit for data packets, which can be giga-packet, kilo-packet, mega-packet, or one-packet.

Description

Use the data-flow-format command to configure the unit in which data flows are sent to a RADIUS Server.

Use the undo data-flow-format command to restore the  default.

By default, data flows are sent in bytes and data packets are sent in one-packet.

Related commands: display radius.

Examples

# Send data flows and data packets to the RADIUS server Test in kilobytes and kilo-packets.

[SecBlade_FW-radius-test] data-flow-format data kilo-byte packet kilo-packet

1.2.3  debugging local-server

Syntax

debugging local-server { all | error | event | packet }

undo debugging local-server { all | error | event | packet }

View

User view

Parameters

all: All debugging.

error: Error debugging.

event: Event debugging.

packet: Packet debugging.

Description

Use the debugging local-server command to enable debugging for the local RADIUS authentication server.

Use the undo debugging local-server command to disable debugging for the local RADIUS authentication server.

By default, debugging for the local RADIUS authentication server is disabled.

Examples

# Enable debugging for the local RADIUS authentication server.

[SecBlade_FW] debugging local-server all

*0.9045238 SecBlade_FW LS/8/EVENT-MSG:Message  received. MessageType = 1

*0.9045238 SecBlade_FW LS/8/PACKET:Packet Received,Code = 1

*0.9045239 SecBlade_FW LS/8/PACKET:Packet Send auth pkt ,Code = 2

1.2.4  debugging radius

Syntax

debugging radius packet

undo debugging radius packet

View

User view

Parameters

packet: Enables packet debugging.

Description

Use the debugging radius command to enable RADIUS debugging.

Use the undo debugging radius command to disable RADIUS debugging.

By default, RADIUS debugging is disabled.

Examples

# Enable RADIUS debugging.

<SecBlade_FW> debugging radius packet

1.2.5  display local-server statistics

Syntax

display local-server statistics

View

Any view

Parameters

None

Description

Use the display local-server statistics command to display statistics of the local RADIUS authentication server.

Related commands: local-server.

Examples

# Display statistics of the local RADIUS authentication server.

<SecBlade_FW> display local-server statistics

The localserver packet statistics:

Receive:                  82          Send:                     61

Discard:                  21          Receive Packet Error:     0

Auth Receive:             82          Auth Send:                61

Acct Receive:             0           Acct Send:                0

1.2.6  display radius scheme

Syntax

display radius scheme [ radius-scheme-name ]

View

Any view

Parameters

radius-scheme-name: Name of the RADIUS scheme, a string of up to 32 characters. If no scheme is specified, all RADIUS schemes are displayed.

Description

Use the display radius scheme command to view the configuration information or statistics of the specified or all RADIUS schemes.

By default, the configuration information about all RADIUS schemes is displayed.

Related commands: radius scheme.

Examples

# Display the configurations of all RADIUS schemes.

<SecBlade_FW> display radius scheme

------------------------------------------------------------------

SchemeName  = system                   Index=0    Type=extended

Primary Auth IP  =127.0.0.1        Port=1645   State=active

Primary Acct IP  =127.0.0.1        Port=1646   State=active

Second  Auth IP  =0.0.0.0          Port=1812   State=block

Second  Acct IP  =0.0.0.0          Port=1813   State=block

Auth Server Encryption Key= Not configured

Acct Server Encryption Key= Not configured

Accounting method = required

TimeOutValue(in second)=3 RetryTimes=3 RealtimeACCT(in minute)=12

Permitted send realtime PKT failed counts       =5

Retry sending times of noresponse acct-stop-PKT =500

Quiet-interval(min)                             =5

Username format                                 =without-domain

Data flow unit                                  =Byte

Packet unit                                     =one packet

------------------------------------------------------------------

Total 1 RADIUS scheme(s). 1 listed

Table 1-4 Description on the fields of the display radius scheme command

Field	Description
SchemeName	Name of the RADIUS scheme
Index	Index number of the RADIUS scheme
Type	Type of the RADIUS server
Primary Auth IP/ Port/ State	IP address, port number and state of the primary authentication server
Primary Acct IP/ Port/ State	IP address, port number and state of the primary accounting server
Second Auth IP/ Port/ State	IP address, port number and state of the secondary authentication server
Second Acct IP/ Port/ State	IP address, port number and state of the secondary accounting server
Auth Server Encryption Key	Shared key of the authentication server
Acct Server Encryption Key	Shared key of the accounting server
TimeOutValue (seconds)	Duration of the RADIUS server timeout timer
Permitted send realtime PKT failed counts	Maximum number of realtime accounting request attempts
Retry sending times of noresponse acct-stop-PKT	Maximum number of buffered stop accounting request attempts
Quiet-interval(min)	Interval for the primary server to resume the active state.
Username format	Format of username
Data flow unit	Unit of data flows
Packet unit	Unit of packets

 

1.2.7  display radius statistics

Syntax

display radius statistics

View

Any view

Parameters

None

Description

Use the display radius statistics command to view the statistics of RADIUS packets. The output can help you troubleshoot RADIUS faults.

Related commands: radius scheme.

Examples

# Display the statistics of RADIUS packets.

<SecBlade_FW> display radius statistics

state statistic(total=1048):

     DEAD=1047     AuthProc=0        AuthSucc=0

AcctStart=0         RLTSend=0         RLTWait=1

 AcctStop=0          OnLine=1            Stop=0

 StateErr=0

 

Received and Sent packets statistic:

Sent PKT total  :38       Received PKT total:2

Resend Times     Resend total

1                12

2                12

Total            24

RADIUS received packets statistic:

Code= 2,Num=1       ,Err=0

Code= 3,Num=0       ,Err=0

Code= 5,Num=1       ,Err=0

Code=11,Num=0       ,Err=0

 

Running statistic:

RADIUS received messages statistic:

Normal auth request             , Num=13      , Err=0       , Succ=13

EAP auth request                , Num=0       , Err=0       , Succ=0

Account request                 , Num=1       , Err=0       , Succ=1

Account off request             , Num=0       , Err=0       , Succ=0

PKT auth timeout                , Num=36      , Err=12      , Succ=24

PKT acct_timeout                , Num=0       , Err=0       , Succ=0

Realtime Account timer          , Num=0       , Err=0       , Succ=0

PKT response                    , Num=2       , Err=0       , Succ=2

EAP reauth_request              , Num=0       , Err=0       , Succ=0

PORTAL access                   , Num=0       , Err=0       , Succ=0

Update ack                      , Num=0       , Err=0       , Succ=0

PORTAL access ack               , Num=0       , Err=0       , Succ=0

Session ctrl pkt                , Num=0       , Err=0       , Succ=0

RADIUS sent messages statistic:

Auth accept                     , Num=0

Auth reject                     , Num=0

EAP auth replying               , Num=0

Account success                 , Num=0

Account failure                 , Num=0

Cut req                         , Num=0

RecError_MSG_sum:0        SndMSG_Fail_sum :0

Timer_Err       :0        Alloc_Mem_Err   :0

State Mismatch  :0        Other_Error     :0

 

No-response-acct-stop packet =0

Discarded No-response-acct-stop packet for buffer overflow =0

Table 1-5 Description on the fields of the display radius statistics command

Field	Description
state statistic(total=1048) DEAD=1047  AuthProc=0    AuthSucc=0 AcctStart=0  RLTSend=0      RLTWait=1 AcctStop=0  OnLine=1       Stop=0 StateErr=0	State statistics Statistics of received & sent packets:   Total outbound packets: 38     Total inbound packets: 2 Retransmission times:       Total packets retransmitted: 1               12 2               12 Total          24 Statistics on RADIUS-received packets: Code = 2, Num = 1       ,Err = 0 One authentication response received, no error packet Code = 3, Num = 0       ,Err = 0 One rejected packet received, no error packet Code= 5, Num = 1       ,Err = 0 One accounting response received, no error packet Code = 11, Num = 0       ,Err = 0 One Access-Challenge (for EAP authentication) packet received, no error packet
Received and Sent packets statistic: Sent PKT total  :38       Received PKT total:2 Resend Times     Resend total 1                12 2                12 Total           24 RADIUS received packets statistic: Code= 2,Num=1       ,Err=0 Code= 3,Num=0       ,Err=0 Code= 5,Num=1       ,Err=0 Code=11,Num=0      ,Err=0	Statistics on RADIUS-received messages: Normal authentication request Count = 13, Error = 0, Success = 0 EAP authentication request Count = 0, Error = 0, Success = 0 Accounting request Count = 0, Error = 0, Success = 0 Accounting stop request Count = 0, Error = 0, Success = 0 Authentication timeout Count = 36, Error = 0, Success = 0 Accounting timeout Count = 0, Error = 0, Success = 0 Number of real-time accounting attempts Count = 0, Error = 0, Success = 0 Response Count = 2, Error = 0, Success = 2 EAP re-authentication request Count = 0, Error = 0, Success = 0 PORTAL access authentication request Count = 13, Error = 0, Success = 0 Upgrade packet Count = 0, Error = 0, Success = 0 Session control packet Authentication request Count = 0, Error = 0, Success = 0 Statistics on RADIUS-sent messages: Authentication succeeds, Count = 0 Authentication rejected,  Count = 0 Accounting succeeds, Count = 0 Accounting fails, Count = 0 EAP authentication response, Count = 0 Accounting succeeds, Count = 0 Accounting fails, Count = 0 Deletion request, Count = 0 Number of error packets received: 0 Number of failed Send attempts: 0 Time error: 0  Memory allocation  error: 0 State mismatch error: 0 Other error: 0
Running statistic: RADIUS received messages statistic: Normal auth request             , Num=13      , Err=0       , Succ=13 EAP auth request                , Num=0       , Err=0       , Succ=0 Account request                 , Num=1       , Err=0       , Succ=1 Account off request             , Num=0       , Err=0       , Succ=0 PKT auth timeout                , Num=36      , Err=12      , Succ=24 PKT acct_timeout                , Num=0       , Err=0       , Succ=0 Realtime Account timer          , Num=0       , Err=0       , Succ=0 PKT response                    , Num=2       , Err=0       , Succ=2 EAP reauth_request              , Num=0       , Err=0       , Succ=0 PORTAL access                   , Num=0       , Err=0       , Succ=0 Update ack                      , Num=0       , Err=0       , Succ=0 PORTAL access ack               , Num=0       , Err=0       , Succ=0 Session ctrl pkt                , Num=0       , Err=0       , Succ=0 RADIUS sent messages statistic: Auth accept                     , Num=0 Auth reject                     , Num=0 EAP auth replying               , Num=0 Account success                 , Num=0 Account failure                 , Num=0 Cut req                         , Num=0 RecError_MSG_sum:0        SndMSG_Fail_sum :0 Timer_Err       :0        Alloc_Mem_Err   :0 State Mismatch  :0        Other_Error     :0	—
No-response-acct-stop packet =0 Discarded No-response-acct-stop packet for buffer overflow =0	The number of unresponded accounting-stop packets is 1. The number of  unresponded accounting-stop packets discarded due to buffer overflow is 0.

 

1.2.8  display stop-accounting-buffer

Syntax

display stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time stop-time | user-name user-name }

View

Any view

Parameters

radius-scheme radius-scheme-name: Displays information on the buffered stop accounting request packets associated with the RADIUS scheme specified by radius-scheme-name. radius-scheme-name is a string of 1 to 32 characters excluding forward slashes (/), colons (:), asterisks (*), question marks (?), less-than signs (<), and greater-than signs (>).

session-id session-id: Displays information on the buffered stop accounting request packets associated with the session ID specified by session-id. session-id is a string of 1 to 50 characters.

time-range start-time stop-time: Displays the buffered stop accounting request packets by the time range. It is specified by start-time and stop-time in the format of hh:mm:ss-mm/dd/yyyy or hh:mm:ss-yyyy/mm/dd, that is, hours:minutes:seconds-months/days/years or hours:minutes:seconds-years/months/days.

user-name user-name : Displays information on the buffered stop accounting request packets by user name.

Description

Use the display stop-accounting-buffer command to view information on stop accounting requests buffered on the SecBlade by RADIUS scheme, session ID, or time range. The displayed packet information can help you troubleshoot RADIUS faults.

When the SecBlade sends a stop accounting request to a RADIUS server but receives no response, it buffers and transmits the packet repeatedly until it receives a response from the RADIUS server. The request attempts can be set using the retry stop-accounting command.

Related commands: reset stop-accounting-buffer, stop-accounting-buffer enable, and retry stop-accounting.

Examples

# Display information on the buffered stop accounting requests between 0:0:0 and 23:59:59 on August 31, 2002.

<SecBlade_FW> display stop-accounting-buffer time-range 0:0:0-08/31/2002 23:59:59-08/31/2002

Total find    0 record

1.2.9  key

Syntax

key { accounting | authentication } string

undo key { accounting | authentication }

View

RADIUS view

Parameters

accounting: Sets/deletes the shared key for encrypting RADIUS accounting packets.

authentication: Sets/deletes the shared key for encrypting RADIUS authentication/authorization packets.

string: Shared key, a string of 1 to 16 characters.

Description

Use the key command to configure a shared key for encrypting RADIUS authentication, authorization or accounting packets.

Use the undo key command to restore the default shared key.

The RADIUS client (that is, the SecBlade) and the RADIUS server use the MD5 algorithm to encrypt the exchanged packets. The two ends verify packets using a shared key. Only when the same key is used can both ends accept the packets from each other and give responses. So, make sure that the same key is set on the SecBlade and the RADIUS server. If the authentication/authorization and accounting are performed on two server devices with different shared keys, you must set one shared key for each.

By default, the key for authentication/authorization packets and accounting packets is none.

Related commands: primary accounting, primary authentication, and radius scheme.

Examples

# In the RADIUS scheme test, set the shared key used for encrypting authentication/authorization packets to hello.

[SecBlade_FW-radius-test] key authentication hello

# In the RADIUS scheme test, set the shared key for encrypting accounting packets to ok.

[SecBlade_FW-radius-test] key accounting ok

1.2.10  local-server

Syntax

local-server nas-ip ip-address key password

undo local-server nas-ip ip-address

View

System view

Parameters

nas-ip ip-address: Specifies the NAS-IP address of the local server, in dotted decimal format.

key password: Specifies a shared key for the local server. Password is a string of 1 to 16 characters.

Description

Use the local-server command to configure a local RADIUS authentication server.

Use the undo local-server command to delete the configured local RADIUS authentication server.

By default, the system creates a local RADIUS authentication server with the NAS-IP address being 127.0.0.1 and the shared key being none.

Note the following:

l           The device not only can serve as the RADIUS client to perform authentication management on users through the authentication/authorization server and the accounting server, but also can function as a simple RADIUS server (including authentication and authorization).

l           If the local RADIUS authentication server function is adopted, the UDP port used for authentication/authorization must be 1645, and the UDP port used for accounting must be 1646.

l           The key configured by this command must be consistent with the key used for authentication/authorization which is configured by the key authentication command in RADIUS scheme view.

l           The device supports up to 16 network access servers, including the local RADIUS authentication server created by the system.

Related commands: radius scheme, state.

Examples

# Set the IP address to 10.110.1.2 and the login password to aabbcc for the local RADIUS authentication server.

[SecBlade_FW] local-server nas-ip 10.110.1.2 key aabbcc

1.2.11  nas-ip

Syntax

nas-ip ip-address

undo nas-ip

View

RADIUS view

Parameters

ip-address: IP address in dotted decimal format.

Description

Use the nas-ip command to set a source IP address for the NAS (the SecBlade) to use as the source IP address of the packets to be sent to the RADIUS server.

Use the undo nas-ip command to remove the configuration.

By specifying the source IP address of RADIUS packets, you  can avoid the situation where the packets sent back by the RADIUS server cannot be received as the result of a physical interface failure. The loopback interface address is usually recommended.

By default, the source IP address of packets is the IP address of the interface where the packets are sent.

Related commands: display radius.

Examples

# Set the source IP address for the NAS (the SecBlade) to send RADIUS packets to 10.1.1.1.

[SecBlade_FW] radius scheme test1

[SecBlade_FW-radius-test1] nas-ip 10.1.1.1

1.2.12  primary accounting

Syntax

primary accounting ip-address [ port-number ]

undo primary accounting

View

RADIUS view

Parameters

ip-address: IP address in dotted decimal format. By default, in system scheme, the IP address of the primary accounting server is 127.0.0.1; in the newly created RADIUS scheme, the IP address of the primary accounting server is 0.0.0.0.

port-number: UDP port number, in the range of 1 to 65535. By default, in system scheme, the UDP port number of the primary accounting server is 1646; in the newly created RADIUS scheme, the UDP port number of the primary accounting server is 1813.

Description

Use the primary accounting command to configure IP address and port number for the primary RADIUS accounting server.

Use the undo primary accounting command to restore the default.

After creating a RADIUS scheme, you need to configure IP address and UDP port for each RADIUS server (including primary/secondary authentication/authorization or accounting server). The configuration of RADIUS servers is at your discretion except that there must be at least one authentication/authorization server and one accounting server. Besides, ensure that the RADIUS service port settings on the SecBlade are consistent with the port settings on the RADIUS servers.

After accounting is completed successfully, both update accounting and stop accounting packets will be sent to the server used when accounting. No primary-secondary switching will occur even if this server is not available. The switching occurs only in the initial authentication, authorization and accounting process.

Related commands: key, radius scheme, and state.

Examples

# Set the IP address of the primary accounting server in the RADIUS scheme test to 10.110.1.2 and use the UDP port 1813 to provide the RADIUS accounting service.

[SecBlade_FW-radius-test] primary accounting 10.110.1.2 1813

1.2.13  primary authentication

Syntax

primary authentication ip-address [ port-number ]

undo primary authentication

View

RADIUS view

Parameters

ip-address: IP address in dotted decimal format. By default, in system scheme, the IP address of the primary authentication/authorization server is 127.0.0.1; in the newly created RADIUS scheme, the IP address of the primary authentication/authorization server is 0.0.0.0.

port-number: UDP port number of the primary authentication/authorization server, in the range of 1 to 65535. By default, in system scheme, the UDP port of the primary authentication/authorization server is 1645; in the newly created RADIUS scheme, the UDP port of the primary authentication/authorization server is 1812.

Description

Use the primary authentication command to configure IP address and port number for the primary RADIUS authentication/authorization server.

Use the undo primary authentication command to restore the default.

After creating a RADIUS scheme, you need to configure IP address and UDP port for each RADIUS server (including primary/secondary authentication/authorization or accounting server). The configuration of RADIUS servers is at your discretion except that there must be at least one authentication/authorization server and one accounting server. Besides, ensure that the RADIUS service port settings on the SecBlade are consistent with the port settings on the RADIUS servers.

Related commands: key, radius scheme, and state.

Examples

# Set the IP address of the primary authentication/authorization server in the RADIUS scheme test to 10.110.1.1 and use the UDP port 1812 to provide the RADIUS authentication/authorization service.

[SecBlade_FW-radius-test] primary authentication 10.110.1.1 1812

1.2.14  radius scheme

Syntax

radius scheme radius-scheme-name

undo radius scheme radius-scheme-name

View

System view

Parameters

radius-scheme-name: RADIUS scheme name, a string of 1 to 32 characters.

Description

Use the radius scheme command to configure a RADIUS scheme and enter its view.

Use the undo radius scheme command to delete the specified RADIUS scheme.

By default, the RADIUS scheme named system exists in the system, with all attributes being the defaults that are not configurable. You can use the display radius command to view the settings of the system scheme.

RADIUS protocol is configured on a per-scheme basis. Each RADIUS scheme must at least define IP addresses and UDP port numbers of RADIUS authentication/authorization/accounting servers and the parameters necessary for the RADIUS client (the SecBlade) to interact with these servers. You must first create a RADIUS scheme and enter its view to configure RADIUS protocol.

A RADIUS scheme can be referenced by several ISP domains at the same time.

The undo radius scheme command can be used to delete any RADIUS scheme except for the default one. Note that a RADIUS scheme currently being used by any online users cannot be removed.

Related commands: key, retry realtime-accounting, scheme, timer realtime-accounting, stop-accounting-buffer enable, retry stop-accounting, server-type, state, user-name-format, retry, display radius and display radius statistics.

Examples

# Create a RADIUS scheme named test and enter its view.

[SecBlade_FW] radius scheme test

[SecBlade_FW-radius-test]

1.2.15  radius nas-ip

Syntax

radius nas-ip ip-address

undo radius nas-ip

View

System view

Parameters

ip-address: A source IP address, which must be the address of this device. It cannot be the address of all zeros, or class D address, or network address, or an address starting with 127.

Description

Use the radius nas-ip command to specify a source address for the NAS to use as the source IP address of the packets to be sent to the RADIUS server.

Use the undo radius nas-ip command to restore the default.

By specifying the source IP address of RADIUS packets, you  can avoid the situation where the packets sent back by the RADIUS server cannot be received as the result of a physical interface failure. The loopback interface address is usually recommended.

By default, the source IP address of packets is the IP address of the interface where the packets are sent.

This command specifies only one source address; therefore, the newly configured source address will overwrite the original one.

Examples

# Set the IP address for the SecBlade to use as the source IP address of RADIUS packets to 129.10.10.1.

[SecBlade_FW] radius nas-ip 129.10.10.1

1.2.16  radius trap

Syntax

radius trap { authentication-server-down | accounting-server-down }

undo radius trap { authentication-server-down | accounting-server-down }

View

System view

Parameters

authentication-server-down: Specifies to send a trap packet when the RADIUS authentication server goes down.

accounting-server-down: Specifies to send a trap packet when the RADIUS accounting server goes down.

Description

Use the radius trap command to configure to send a trap packet when the RADIUS server goes down.

Use the undo radius trap command to configure not to send a trap packet when the RADIUS server goes down.

By default, no trap packet is sent when the RADIUS server goes down.

Examples

# Configure to send a trap packet when the RADIUS server goes down.

[SecBlade_FW] radius trap authentication-server-down

1.2.17  reset radius statistics

Syntax

reset radius statistics

View

User view

Parameters

None

Description

Use the reset radius statistics command to clear the statistics of the RADIUS protocol.

Related commands: display radius.

Examples

# Clear the RADIUS protocol statistics.

<SecBlade_FW> reset radius statistics

1.2.18  reset stop-accounting-buffer

Syntax

reset stop-accounting-buffer { radius-scheme radius-scheme-name | session-id session-id | time-range start-time stop-time | user-name user-name }

View

User view

Parameters

radius-scheme radius-scheme-name: Clears the buffered stop accounting request packets associated with the RADIUS scheme specified by radius-scheme-name. radius-scheme-name is a string of 1 to 32 characters.

session-id session-id: Clears the buffered stop accounting requests associated with the session ID specified by session-id, a string of up to 50 characters.

time-range start-time stop-time: Clears the buffered stop accounting requests by the time range. The time range is specified by start-time and stop-time in the format of hh:mm:ss-mm/dd/yyyy or hh:mm:ss-yyyy/mm/dd, that is, hours:minutes:seconds-months/days/years or hours:minutes:seconds-years/months/days.

user-name user-name: Clears the buffered stop accounting requests by user name.

Description

Use the reset stop-accounting-buffer command to clear the buffered stop accounting requests that are not responded.

When the SecBlade sends a stop accounting packet to a RADIUS server but receives no response, it buffers and transmits the packet repeatedly until it receives a response from the RADIUS server. The request attempts can be set using the retry stop-accounting command.

You can clear the buffered stop accounting requests by RADIUS scheme, session ID, username, or time range.

Related commands: stop-accounting-buffer enable, retry stop-accounting, and display stop-accounting-buffer.

Examples

# Clear the buffered stop accounting requests associated with the user [email protected].

<SecBlade_FW> reset stop-accounting-buffer user-name [email protected]

# Clear the buffered stop accounting requests in the time range 0:0:0 to 23:59:59 on August 31, 2002.

<SecBlade_FW> reset stop-accounting-buffer time-range 0:0:0-08/31/2002 23:59:59-08/31/2002

1.2.19  retry

Syntax

retry retry-times

undo retry

View

RADIUS view

Parameters

retry-times: Maximum number of request attempts, in the range of 1 to 20. By default, it is 3.

Description

Use the retry command to configure the maximum number of RADIUS request attempts.

Use the undo retry command to restore the default.

The RADIUS protocol carries data in UDP packet, so its communication is unreliable. If the NAS receives no response from the current RADIUS server when the response timeout timer expires, it has to retransmit the RADIUS request. Assume that the retry-times is N. If the NAS has not received any response from the active RADIUS server when the (N-[N/2]) attempts is reached, it considers that the current RADIUS server is disconnected and turns to another RADIUS server.

Appropriately setting the retry-times parameter as required can speed up system response.

Related commands: radius scheme.

Examples

# Set the maximum number of RADIUS request attempts to 5 in the RADIUS scheme Test.

[SecBlade_FW-radius-test] retry 5

1.2.20  retry realtime-accounting

Syntax

retry realtime-accounting retry-times

undo retry realtime-accounting

View

RADIUS view

Parameters

retry-times: Maximum number of real time accounting request attempts, in the range of 1 to 255.

Description

Use the retry realtime-accounting command to configure the maximum number of real time accounting request attempts.

Use the undo retry realtime-accounting command to restore the default.

A RADIUS server usually checks a user is online using a timeout timer. If the RADIUS server has not received real time accounting packet from NAS for a long period of time, it will consider that there is line or device failure and stop accounting against the user. Accordingly, it is necessary to disconnect the user on the NAS and on the RADIUS server synchronously when some unexpected failure occurs. The SecBlade supports the setting of the maximum number of real time accounting request attempts. The NAS will disconnect the user if it has not received real time accounting response from the RADIUS server when the predefined retry-times is reached.

Suppose the response timeout timer of the RADIUS server is T and the real-time accounting interval of NAS is t. Set T to 3 seconds, t to 12 minutes, and the maximum number of real time accounting request attempts of the NAS to 5. With these values being configured, the NAS generates an accounting request every 12 minutes. If no response is received within 3 seconds, the NAS retransmits the accounting request. This continues until the maximum number of attempts is reached. Normally, the result of retry-times multiple by T should be less than t.

The default realtime accounting request attempts is 5.

Related commands: radius scheme and timer realtime-accounting.

Examples

# Set the maximum number of real time accounting request attempts to 10 in the RADIUS scheme Test.

[SecBlade_FW-radius-test] retry realtime-accounting 10

1.2.21  retry stop-accounting

Syntax

retry stop-accounting retry-times

undo retry stop-accounting

View

RADIUS view

Parameters

retry-times: Maximum number of the buffered stop accounting request attempts, in the range of 10 to 65,535.

Description

Use the retry stop-accounting command to configure the maximum number of stop accounting request attempts.

Use the undo retry stop-accounting command to restore the default.

Given the influence of a stop accounting packet on billing and eventually charging, it has importance for both users and ISPs. Therefore, the NAS should make its best effort to send the stop accounting packet to the RADIUS accounting server. If the SecBlade receives no response from the RADIUS accounting server, it buffers locally and retransmits the packet until the RADIUS accounting server responds, or it discards the packet when the predefined retry-times is reached.

By default, the maximum number of stop accounting request attempts is 500.

Related commands: reset stop-accounting-buffer, radius scheme, display stop-accounting-buffer.

Examples

# Set the maximum number of stop accounting request attempts to 1000 in the RADIUS scheme Test.

[SecBlade_FW-radius-test] retry stop-accounting 1000

1.2.22  secondary accounting

Syntax

secondary accounting ip-address [ port-number ]

undo secondary accounting

View

RADIUS view

Parameters

ip-address: IP address, in dotted decimal format. By default, the IP address of the secondary accounting server is 0.0.0.0.

port-number: UDP port number, in the range of 1 to 65,535. By default, the secondary accounting server use the UDP port number 1813.

Description

Use the secondary accounting command to configure IP address and port number for the secondary RADIUS accounting server.

Use the undo secondary accounting command to restore the defaults.

For detailed information, refer to the description of the primary accounting command.

Related commands: key, radius scheme, and state.

Examples

# Set the IP address of the secondary accounting server in the RADIUS scheme test to 10.110.1.1 and use the UDP port 1813 to provide the RADIUS accounting service.

[SecBlade_FW-radius-test] secondary accounting 10.110.1.1 1813

1.2.23  secondary authentication

Syntax

secondary authentication ip-address [ port-number ]

undo secondary authentication

View

RADIUS view

Parameters

ip-address: IP address in dotted decimal format.

port-number: UDP port number, in the range of 1 to 65,535. By default, the secondary authentication server uses the UDP port 1812.

Description

Use the secondary authentication command to configure IP address and port number for the secondary RADIUS authentication/authorization server.

Use the undo secondary authentication command to restore the default.

For detailed information, refer to the description of the primary authentication command.

By default, the IP address of the secondary authentication/authorization server is 0.0.0.0.

Related commands: key, radius scheme, and state.

Examples

# Set the IP address of the secondary authentication/authorization server in the RADIUS scheme test to 10.110.1.2 and use the UDP port 1812 to provide the RADIUS authentication/authorization service.

[SecBlade_FW-radius-test] secondary authentication 10.110.1.2 1812

1.2.24  server-type

Syntax

server-type { extended | standard }

undo server-type

View

RADIUS view

Parameters

extended: Specifies to use the H3C RADIUS server (generally CAMS), which requires the RADIUS client (the SecBlade) and the RADIUS server to interact according to the regulation and packet format provisioned by the private RADIUS protocol of H3Ci Technologies.

standard: Specifies to use the standard RADIUS server, which requires the RADIUS client (the SecBlade) and the RADIUS server to interact according to the regulation and packet format of standard RADIUS protocol (RFC 2138/2139 or newer).

Description

Use the server-type command to configure the RADIUS server type supported by the SecBlade.

Use the undo server-type command to restore the default.

By default, in system scheme, the RADIUS server type is extended; in the newly created RADIUS scheme, the RADIUS server type is standard.

Related commands: radius scheme.

Examples

# Set the RADIUS server type of the RADIUS scheme test to extended.

[SecBlade_FW-radius-test] server-type extended

1.2.25  state

Syntax

state { primary | secondary } { accounting | authentication } { block | active }

View

RADIUS view

Parameters

primary: Sets the state for the primary RADIUS authentication/authorization or accounting server.

secondary: Sets the state for the secondary RADIUS authentication/authorization or accounting server.

accounting: Sets the state for the primary or secondary RADIUS accounting server.

authentication: Sets the state for the primary or secondary RADIUS authentication/authorization server.

block: Sets the state to block.

active: Sets the state to active, namely the normal operation state.

Description

Use the state command to configure the state a RADIUS server.

By default, in system scheme, the primary authentication/authorization and accounting servers are in active state, and the secondary authentication/authorization and accounting servers are in block state; in the newly created RADIUS scheme, all RADIUS servers are in block state..

When the primary server (accounting or authentication/authorization) in a RADIUS scheme becomes unavailable, the NAS automatically turns to the secondary server. After the primary one recovers, however, the NAS does not resume the communication with it at once. Instead, the NAS continues the communication with the secondary one and turns to the primary one again only after the secondary one fails. To have the NAS communicate with the primary server right after its recovery, you can manually set the state of the primary server to active.

When both the primary and secondary servers are active or block, the NAS only sends packets to the primary server.

Related commands: radius scheme, primary authentication, secondary authentication, primary accounting, secondary accounting.

Examples

# Set the state of the secondary authentication server in the RADIUS scheme test to active.

[SecBlade_FW-radius-test] state secondary authentication active

1.2.26  stop-accounting-buffer enable

Syntax

stop-accounting-buffer enable

undo stop-accounting-buffer enable

View

RADIUS view

Parameters

None

Description

Use the stop-accounting-buffer enable command to enable the SecBlade to buffer the stop accounting requests that are not responded.

Use the undo stop-accounting-buffer enable command to disable the function.

By default, the SecBlade is enabled to buffer the stop accounting requests that are not responded.

Given the influence of a stop accounting packet on billing and eventually charging, it has importance for both users and ISPs. Therefore, the NAS should make its best effort to send the stop accounting packet to the RADIUS accounting server. If the SecBlade receives no response from the RADIUS accounting server, it buffers the packet locally and sends repeatedly until the RADIUS accounting server responds, or it discards the packet when the predefined retry-times is reached.

Related commands: reset stop-accounting-buffer, radius scheme, display stop-accounting-buffer.

Examples

# In the RADIUS scheme Test, enable the SecBlade to buffer the stop accounting requests that are not responded.

[SecBlade_FW-radius-test] stop-accounting-buffer enable

1.2.27  timer quiet

Syntax

timer quiet minutes

undo timer quiet

View

RADIUS view

Parameters

minutes: Duration, in the range of 1 to 255.

Description

Use the timer quiet command to set the duration that the primary server must wait before it resumes the active state.

Use the undo timer quiet command to restore the default (five minutes).

By default, the primary server must wait five minutes before it resumes the active state.

Related commands: display radius.

Examples

# Set the quiet timer for the primary server to ten minutes.

[SecBlade_FW] radius scheme test1

[SecBlade_FW-radius-test1] timer quiet  10

1.2.28  timer realtime-accounting

Syntax

timer realtime-accounting minutes

undo timer realtime-accounting

View

RADIUS view

Parameters

minutes: Real time accounting interval, a multiple of 3 in the range of 3 to 60 minutes.

Description

Use the timer realtime-accounting command to configure a real time accounting interval.

Use the undo timer realtime-accounting command to restore the default interval.

The setting of real time accounting interval is indispensable to real time accounting. After an interval value is set, the NAS transmits the accounting information of online users to the RADIUS accounting server at intervals of this value.

The setting of real time accounting interval somewhat depends on the performance of the NAS and the RADIUS server: a shorter interval requires higher device performance. You are therefore recommended to adopt a longer interval when there are a large number of users (more than 1000, inclusive). The following table recommends the ratio of minutes to the number of users.

Table 1-6 Recommended ratio of minutes to the number of users

Number of users	Real time accounting interval (minute)
1 – 99	3
100 – 499	6
500 – 999	12
≥1000	≥15

 

By default, the interval of realtime accounting is 12 minutes.

Related commands: retry realtime-accounting and radius scheme.

Examples

# Set the real time accounting interval in the RADIUS scheme test to 51 minutes.

[SecBlade_FW-radius-test] timer realtime-accounting 51

1.2.29  timer response-timeout

Syntax

timer seconds

undo timer

timer response-timeout seconds

undo timer response-timeout

View

RADIUS view

Parameters

seconds: RADIUS server response timeout time, in the range of 1 to 10 seconds.

Description

Use the timer response-timeout command and the timer command to configure the RADIUS server response time out timer.

Use the undo timer command and the undo timer response-timeout command to restore the default.

If the NAS receives no response from the RADIUS server after sending a RADIUS request (authentication/authorization or accounting request) packet for a period, the NAS has to retransmit the packet, thus ensuring the user can obtain the RADIUS service. You can specify this period by setting the RADIUS server response timeout timer using the timer command and the timer response-timeout command.

By default, the response timeout timer of the RADIUS server is three seconds.

Related commands: radius scheme and retry.

Examples

# Set the response timeout timer in the RADIUS scheme test to 5 seconds.

[SecBlade_FW-radius-test] timer response-timeout 5

1.2.30  user-name-format

Syntax

user-name-format { with-domain | without-domain }

View

RADIUS view

Parameters

with-domain: Specifies to send a user name with domain name to the RADIUS server.

without-domain: Specifies to send a user name without domain name to the RADIUS server.

Description

Use the user-name-format command to configure the format of the username to be sent to the RADIUS server.

By default, in system scheme, the NAS sends user names without domain names to the RADIUS server; in the newly created RADIUS scheme, the NAS sends user names with domain names to the RADIUS server.

The supplicants are generally named in the userid@isp-name format, of which isp-name is used by the SecBlade to decide the ISP domain to which a supplicant belongs. Some earlier RADIUS servers, however, cannot recognize usernames with an ISP domain name. Before sending a username including a domain name to such a RADIUS server, the SecBlade must remove the domain name. This command is thus provided for you to decide whether to include a domain name in a username to be sent to a RADIUS server.

 

 

Related commands: radius scheme.

Examples

# Send the username without domain name to the RADIUS servers in the RADIUS scheme test.

[SecBlade_FW-radius-test] user-name-format without-domain

1.3  HWTACACS Configuration Commands

1.3.1  data-flow-format

Syntax

data-flow-format data { byte | giga-byte | kilo-byte | mega-byte }

data-flow-format packet { giga-packet | kilo-packet | mega-packet | one-packet }

undo data-flow-format { data | packet }

View

HWTACACS view

Parameters

data: Specifies the unit for data flows, which can be byte, kilobyte, megabyte, or gigabyte.

packet: Specifies the unit for data packets, which can be giga-packet, kilo-packet, mega-packet, or one-packet.

Description

Use the data-flow-format command to specify the unit for data flows or packets to be sent to a TACACS server.

Use the undo data-flow-format command to restore the default.

By default, the unit for data flows is byte and that for data packets is one-packet.

Related commands: display hwtacacs.

Examples

# Send data flows and data packets to the TACACS server Test in kilobytes and kilopakets respectively.

[SecBlade_FW-hwtacacs-test] data-flow-format data kilo-byte packet kilo-packet

1.3.2  debugging hwtacacs

Syntax

debugging hwtacacs { all | error | event | message | receive-packet | send-packet }

undo debugging hwtacacs { all | error | event | message | receive-packet | send-packet }

View

User view

Parameters

all: Enables all HWTACACS debugging.

error: Enables error debugging.

event: Enables event debugging.

message: Enables message debugging.

receive-packet: Enables incoming packet debugging.

send-packet: Enables outgoing packet debugging.

Description

Use the debugging hwtacacs command to enable HWTACACS debugging.

Use the undo debugging hwtacacs command to disable HWTACACS debugging.

By default, HWTACACS debugging is disabled.

Examples

# Enable the event debugging of HWTACACS.

<SecBlade_FW> debugging hwtacacs event

1.3.3  display hwtacacs scheme

Syntax

display hwtacacs scheme [ hwtacacs-scheme-name [ statistics ] ]

View

Any view

Parameters

hwtacacs-scheme-name: HWTACACS scheme name, a string of 1 to 32 case-insensitive characters. If no HWTACACS scheme is specified, the system displays the configuration of all HWTACACS schemes.

statistics: Displays statistics about HWTACACS packets.

Description

Use the display hwtacacs scheme command to view the configuration information of a specified or all HWTACACS schemes.

Without any parameter specified, the command displays the configuration information of all HWTACACS schemes.

Related commands: hwtacacs scheme.

Examples

# View the configuration information of HWTACACS scheme gy.

<SecBlade_FW> display hwtacacs scheme gy

--------------------------------------------------------------------  HWTACACS-server template name   : gy

  Primary-authentication-server   : 172.31.1.11:49

  Primary-authorization-server    : 172.31.1.11:49

  Primary-accounting-server       : 172.31.1.11:49

  Secondary-authentication-server : 0.0.0.0:0

  Secondary-authorization-server  : 0.0.0.0:0

  Secondary-accounting-server     : 0.0.0.0:0

  Current-authentication-server   : 172.31.1.11:49

  Current-authorization-server    : 172.31.1.11:49

  Current-accounting-server       : 172.31.1.11:49

  Source-IP-address               : 0.0.0.0

  key authentication              : 790131

  key authorization               : 790131

  key accounting                  : 790131

  Quiet-interval(min)             : 5

  Response-timeout-Interval(sec)  : 5

  Domain-included                 : No

  Traffic-unit                    : B

Packet traffic-unit             : one-packet

Table 1-7 Description on the fields of the display hwtacacs scheme command

Field	Description
HWTACACS-server template name	HWTACACS server template name (that is, HWTACACS scheme name)
Primary-authentication-server	IP address and port number of the primary authentication server
Primary-authorization-server	IP address and port number of the primary authorization server
Primary-accounting-server	IP address and port number of the primary accounting server
Secondary-authentication-server	IP address and port number of the secondary authentication server
Secondary-authorization-server	IP address and port number of the secondary authorization server
Secondary-accounting-server	IP address and port number of the secondary accounting server
Current-authentication-server	IP address and port number of the active authentication server
Current-authorization-server	IP address and port number of the active authorization server
Current-accounting-server	IP address and port number of the active accounting server
Source-IP-address	Source IP address used by the router to send HWTACACS packets
key authentication	Shared key of the HWTACACS authentication server
key authorization	Shared key of the HWTACACS authorization server
key accounting	Shared key of the HWTACACS accounting server
Quiet-interval(min)	Time period that the primary server waits before it resumes the active state
Response-timeout-Interval(sec)	Response timeout time of the TACACS server
Domain-included	Format of the user name sent to the TACACS server, including domain name
Traffic-unit	Unit of data flows: B: Data are sent in bytes. GB: Data are sent in gigabytes. KB: Data are sent in kilobytes. MB: Data are sent in megabytes.
Packet traffic-unit	Unit of data packets: giga-packet: Data packets are sent in giga-packets. kilo-packet: Data packets are sent in kilo-packets. mega-packet: Data packets are sent in mega-packets. one-packet: Data packets are sent in one-packet.

 

1.3.4  display stop-accounting-buffer

Syntax

display stop-accounting-buffer hwtacacs-scheme hwtacacs-scheme-name

View

Any view

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Displays information on the buffered stop accounting requests associated with the HWTACACS scheme specified by hwtacacs-scheme-name, a string of 1 to 32 characters.

Description

Use the display stop-accounting-buffer command to view information on the stop accounting requests buffered on the SecBlade.

Related commands: reset stop-accounting-buffer, stop-accounting-buffer enable, and retry stop-accounting.

Examples

# Display information on the buffered stop accounting requests associated with HWTACACS scheme test.

<SecBlade_FW> display stop-accounting-buffer hwtacacs-scheme test

-------------------------------------------------------------

NO. SendTime      IP Address                         Template

  1       10               172.31.1.27                          test

-------------------------------------------------------------

Whole accounting stop packet to resend:1  

Table 1-8 Description on the fields of the display stop-accounting-buffer command

Filed	Description
NO.	Sequence number of the stop accounting request packet
SendTime	Number of the stop accounting request packets
IP Address	IP address of the TACACS server
Template	Name of the HWTACACS authentication scheme

 

1.3.5  hwtacacs nas-ip

Syntax

hwtacacs nas-ip ip-address

undo hwtacacs nas-ip

View

System view

Parameters

ip-address: Source IP address. It must be the address of this device. and cannot be the address of all zeros, class D address, or network address, or an address starting with 127.

Description

Use the hwtacacs nas-ip command to specify the source address for the NAS to use as the source IP address of HWTACACS packets.

Use the undo hwtacacs nas-ip command to restore the default setting.

By specifying the source IP address of HWTACACS packets, you can avoid the situation where the packets sent back by the TACACS server cannot be received as the result of a physical interface failure. The loopback interface address is usually recommended.

By default, the source IP address of packets is the IP address of the interface where the packets are sent.

This command specifies only one source address; therefore, the newly configured source address may overwrite the original one.

Examples

# Configure the SecBlade to send HWTACACS packets from 129.10.10.1.

[SecBlade_FW] hwtacacs nas-ip 129.10.10.1

1.3.6  hwtacacs scheme

Syntax

hwtacacs scheme hwtacacs-scheme-name

undo hwtacacs scheme hwtacacs-scheme-name

View

System view

Parameters

hwtacacs-scheme-name: HWTACACS scheme name, a string of 1 to 32 characters.

Description

Use the hwtacacs scheme command to create an HWTACACS scheme and enter HWTACACS scheme view.

Use the .undo hwtacacs scheme command to delete an HWTACACS scheme.

Examples

# Create an HWTACACS scheme named test1 and enter HWTACACS scheme view.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1]

1.3.7  key

Syntax

key { accounting | authentication | authorization } string

undo key { accounting | authentication | authorization }

View

HWTACACS view

Parameters

accounting: Specifies the shared key for the accounting server.

authentication: Specifies the shared key for the authentication server.

authorization: Specifies the shared key for the authorization server.

string: Shared key, a string of 1 to 16 characters.

Description

Use the key command to configure a shared key for the TACACS authentication, authorization or accounting server.

Use the undo key command to remove the configuration.

By default, no key is set for any TACACS server.

The TACACS client (the SecBlade) and the TACACS server use the MD5 algorithm to encrypt the exchanged packets. The two ends verify packets using a shared key. Only when the same key is used can both ends accept the packets from each other and give responses. Therefore, it is necessary to ensure that the same key is set on the SecBlade and the TACACS server. If the authentication/authorization and accounting are performed on two server devices with different shared keys, you must set one shared key for each.

Related commands: display hwtacacs.

Examples

# Use hello as the shared key for  the TACACS accounting server.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1] key accounting hello

1.3.8  nas-ip

Syntax

nas-ip ip-address

undo nas-ip

View

HWTACACS view

Parameters

ip-address: IP address in dotted decimal format.

Description

Use the nas-ip command to specify the source address for the NAS (the SecBlade) to send HWTACACS packets.

Use the undo nas-ip command to remove the setting.

By specifying the source address of HWTACACS packets, you can avoid the situation where the packets sent back by the TACACS server cannot be received as the result of a physical interface failure. The loopback interface address is usually recommended.

By default, the source IP address of packets is the IP address of the interface where the packets are sent.

Related commands: display hwtacacs.

Examples

# Configure the NAS to send HWTACACS packets from 10.1.1.1.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1] nas-ip 10.1.1.1

1.3.9  primary accounting

Syntax

primary accounting ip-address [ port ]

undo primary accounting

View

HWTACACS view

Parameters

ip-address: IP address of the primary accounting server, a valid unicast address in dotted decimal format.

port: Port number of the primary accounting server, which is in the range 1 to 65,535 and defaults to 49.

Description

Use the primary accounting command to configure a primary TACACS accounting server.

Use the undo primary accounting command to delete the configured primary TACACS accounting server.

By default, IP address of the primary TACACS accounting server is 0.0.0.0.

You are not allowed to assign the same IP address to both the primary and secondary accounting servers.

You can configure only one primary accounting server in a HWTACACS scheme. If you enter this command multiple times consecutively, only the late configuration applies.

You can remove an accounting server only when no active TCP connection for sending accounting packets is using it.

After accounting is completed successfully, both update accounting and stop accounting packets will be sent to the server used when accounting. No primary-secondary switching will occur even if this server is not available. The switching occurs only in the initial authentication, authorization and accounting process.

Examples

# Configure a primary accounting server.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1] primary accounting 10.163.155.12 49

1.3.10  primary authentication

Syntax

primary authentication ip-address [ port ]

undo primary authentication

View

HWTACACS view

Parameters

ip-address: IP address of the primary authentication server, a valid unicast address in dotted decimal format.

port: Port number of the primary authentication server, which is in the range 1 to 65535 and defaults to 49.

Description

Use the primary authentication command to configure a primary TACACS authentication server.

Use the undo primary authentication command to delete the configured authentication server.

By default, IP address of the primary TACACS authentication server is 0.0.0.0.

You are not allowed to assign the same IP address to both primary and secondary authentication servers.

You can configure only one primary authentication server in a HWTACACS scheme. If you enter this command multiple times consecutively, only the late configuration applies.

You can remove an authentication server only when no active TCP connection for sending accounting packets is using it.

Related commands: display hwtacacs.

Examples

# Configure a primary authentication server.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1] primary authentication 10.163.155.13 49

1.3.11  primary authorization

Syntax

primary authorization ip-address [ port ]

undo primary authorization

View

HWTACACS view

Parameters

ip-address: IP address of the primary authorization server, a valid unicast address in dotted decimal format.

port: Port number of the primary authorization server, which is in the range of 1 to 65535 and defaults to 49.

Description

Use the primary authorization command to configure a primary TACACS authorization server.

Use the undo primary authorization command to delete the configured primary authorization server.

By default, IP address of the primary TACACS authorization server is 0.0.0.0.

If TACACS authentication is configured for a user without TACACS authorization server, the user cannot log in regardless of its user type.

You are not allowed to assign the same IP address to both primary and secondary authorization servers.

You can configure only one primary authorization server in a HWTACACS scheme. If you enter this command multiple times consecutively, only the late configuration applies.

You can remove an authorization server only when no active TCP connection for sending accounting packets is using it.

Related commands: display hwtacacs.

Examples

# Configure a primary authorization server.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1] primary authorization 10.163.155.13 49

1.3.12  reset hwtacacs statistics

Syntax

reset hwtacacs statistics { accounting | authentication | authorization | all }

View

User view

Parameters

accounting: Clears all the HWTACACS accounting statistics.

authentication: Clears all the HWTACACS authentication statistics.

authorization: Clears all the HWTACACS authorization statistics.

all: Clears all statistics.

Description

Use the reset hwtacacs statistics command to clear HWTACACS protocol statistics.

Related commands: display hwtacacs.

Examples

# Clear all HWTACACS protocol statistics.

<SecBlade_FW> reset hwtacacs statistics all

1.3.13  reset stop-accounting-buffer

Syntax

reset stop-accounting-buffer hwtacacs-scheme hwtacacs-scheme-name

View

User view

Parameters

hwtacacs-scheme hwtacacs-scheme-name: Configures to delete the stop accounting requests from the buffer according to the specified HWTACACS scheme name. The hwtacacs-scheme-name specifies the HWTACACS scheme name with a string of 1 to 32 characters.

Description

Use the reset stop-accounting-buffer command to clear the stop accounting requests that have no response and are buffered on the SecBlade.

Related commands: stop-accounting-buffer enable, retry stop-accounting, display stop-accounting-buffer.

Examples

# Delete the buffered stop accounting requests by HWTACACS scheme test.

<SecBlade_FW> reset stop-accounting-buffer hwtacacs-scheme test

1.3.14  retry stop-accounting

Syntax

retry stop-accounting retry-times

undo retry stop-accounting

View

HWTACACS view

Parameters

retry-times: Maximum number of real time accounting request attempts, in the range 1 to 300.

Description

Use the retry stop-accounting command to enable stop accounting request retransmission and configure the maximum number of stop accounting request attempts.

Use the undo retry stop-accounting command to restore the default setting.

By default, stop accounting request retransmission is enabled and the maximum number of request attempts is set to 100.

Related commands: reset stop-accounting-buffer, hwtacacs scheme, and display stop-accounting-buffer.

Examples

# Enable stop accounting request retransmission and set the maximum number of request attempts to 50.

[SecBlade_FW-hwtacacs-test] retry stop-accounting 50

1.3.15  secondary accounting

Syntax

secondary accounting ip-address [ port ]

undo secondary accounting

View

HWTACACS view

Parameters

ip-address: IP address of the secondary accounting server, a valid unicast address in dotted decimal format.

port: Port number of the secondary accounting server, which is in the range 1 to 65,535 and defaults to 49.

Description

Use the secondary accounting command to configure a secondary TACACS accounting server.

Use the undo secondary accounting command to delete the configured secondary TACACS accounting server.

By default, IP address of the secondary TACACS accounting server is 0.0.0.0.

You are not allowed to assign the same IP address to both primary and secondary accounting servers.

You can configure only one secondary accounting server in a HWTACACS scheme. If you repeatedly use this command, only the latest configuration takes effect.

You can remove an accounting server only when no active TCP connection for sending accounting packets is using it.

Examples

# Configure a secondary accounting server.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1] secondary accounting 10.163.155.12 49

1.3.16  secondary authentication

Syntax

secondary authentication ip-address [ port ]

undo secondary authentication

View

HWTACACS view

Parameters

ip-address: IP address of the secondary authentication server, a valid unicast address in dotted decimal format.

port: Port number of the secondary authentication server, which is in the range 1 to 65,535 and defaults to 49.

Description

Use the secondary authentication command to configure a secondary TACACS authentication server.

Use the undo secondary authentication command to delete the configured secondary authentication server.

By default, IP address of the secondary TACACS authentication server is 0.0.0.0.

You are not allowed to assign the same IP address to both primary and secondary authentication servers.

You can configure only one primary authentication server in a HWTACACS scheme. If you repeatedly use this command, only the latest configuration takes effect.

You can remove an authentication server only when no active TCP connection for sending accounting packets is using it.

Related commands: display hwtacacs.

Examples

# Configure a secondary authentication server.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1] secondary authentication 10.163.155.13 49

1.3.17  secondary authorization

Syntax

secondary authorization ip-address [ port ]

undo secondary authorization

View

HWTACACS view

Parameters

ip-address: IP address of the secondary authorization server, a valid unicast address in dotted decimal format.

port: Port number of the secondary authorization server, ranging from 1 to 65535. By default, it is 49.

Description

Use the secondary authorization command to configure a secondary TACACS authorization server.

Use the .undo secondary authorization command to delete the configured secondary authorization server.

By default, IP address of the secondary TACACS authorization server is 0.0.0.0.

You are not allowed to assign the same IP address to both primary and secondary authorization servers.

You can configure only one primary authorization server in a HWTACACS scheme. If you repeatedly use this command, only the latest configuration takes effect.

You can remove an authorization server only when no active TCP connection for sending accounting packets is using it.

Related commands: display hwtacacs.

Examples

# Configure the secondary authorization server.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1] secondary authorization 10.163.155.13 49

1.3.18  stop-accounting-buffer enable

Syntax

stop-accounting-buffer enable

undo stop-accounting-buffer enable

View

HWTACACS view

Parameters

None

Description

Use the stop-accounting-buffer enable command to enable the SecBlade to buffer the stop accounting request packets that are not responded.

Use the undo stop-accounting-buffer enable command to disable the function.

By default, the stop accounting request packets with no response can be buffered on the SecBalde.

For detailed description, refer to the stop-accounting-buffer enable command in the RADIUS scheme.

Examples

# For the server in the HWTACACS scheme named test, allow the SecBlade to buffer stop accounting request packets that are not responded.

[SecBlade_FW-hwtacacs-test] stop-accounting-buffer enable

1.3.19  timer quiet

Syntax

timer quiet minutes

undo timer quiet

View

HWTACACS view

Parameters

minutes: Quiet period, in the range of 1 to 255 minutes.

Description

Use the timer quiet command to set the duration that a primary server must wait before it resumes the active state.

Use the undo timer quiet command to restore the default (five minutes).

By default, the primary server must wait five minutes before it resumes the active state.

Related commands: display hwtacacs.

Examples

# Set the quiet timer for the primary server to ten minutes.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1] timer quiet 10

1.3.20  timer realtime-accounting

Syntax

timer realtime-accounting minutes

undo timer realtime-accounting

View

HWTACACS view

Parameters

minutes: Real time accounting interval, which must be a multiple of 3 in the range 3 to 60 minutes.

Description

Use the timer realtime-accounting command to configure a real time accounting interval.

Use the undo timer realtime-accounting command to restore the default interval.

Real time accounting interval is necessary for real time accounting. After an interval value is set, the NAS transmits the accounting information of online users to the TACACS accounting server at intervals of this value.

The setting of real time accounting interval depends somewhat on the performance of the NAS and the TACACS server: a shorter interval requires higher device performance. You are therefore recommended to adopt a longer interval when there are a large number of users (more than 1000, inclusive). The following table recommends the ratio of minutes to the number of users.

Table 1-9 Recommended ratio of minutes to the number of users

Number of users	Real time accounting interval (minute)
1 – 99	3
100 – 499	6
500 – 999	12
≥ 1,000	≥ 15

 

By default, the real time accounting interval is 12 minutes.

Related commands: retry realtime-accounting and radius scheme.

Examples

# Set the real time accounting interval in the HWTACACS scheme test to 51 minutes.

[SecBlade_FW-hwtacacs-test] timer realtime-accounting 51

1.3.21  timer response-timeout

Syntax

timer response-timeout seconds

undo timer response-timeout

View

HWTACACS view

Parameters

seconds: Response timeout time, in the range of 1 to 300 seconds.

Description

Use the timer response-timeout command to set the response timeout timer of the TACACS server.

Use the .undo timer response-timeout command to restore the default (five seconds).

By default, the response timeout timer of the TACACS server is five seconds.

 

 

Related commands: display hwtacacs.

Examples

# Set the response timeout time of the TACACS server to 30 seconds.

[SecBlade_FW] hwtacacs scheme test1

[SecBlade_FW-hwtacacs-test1] timer response-timeout 30

1.3.22  user-name-format

Syntax

user-name-format { with-domain | without-domain }

View

HWTACACS view

Parameters

with-domain: Specifies to send the username with domain name to the TACACS servers

without-domain: Specifies to send the username without domain name to the TACACS servers

Description

Use the user-name-format command to configure the username format sent to the TACACS servers.

By default, HWTACACS scheme acknowledges that the username sent to the TACACS servers includes ISP domain name.

The supplicants are generally named in userid@isp-name format. The part following the @ sign is the ISP domain name, according to which the SecBlade assigns a user to the corresponding ISP domain. However, some earlier TACACS servers reject the user name including ISP domain name. In this case, the user name is sent to the TACACS server after its domain name is removed. Accordingly, the SecBlade provides this command to decide whether the username is sent to the TACACS servers carrying ISP domain name or not.

 

 

Related commands: hwtacacs scheme.

Examples

# Specify to send the username without domain name.

[SecBlade_FW-hwtacacs-test] user-name-format without-domain