H3C認證服務器radius 冗余備份

H3C認證服務器冗余備份如圖：client1、client2分別是radius主備服務器，做認證服務器冗余備份。LSW1為H3CS3610三層交換機交換機S3610配置如下：<H3C>displaycurrent-configuration#version5.20,Release5309#sysnameH3C#superpasswordlevel2cipher11X$V%+*7&'Q=aQ'MAF4v1!!/配置super密碼superpasswordlevel3cipher11X$V%+*7&'Q=aQ'MAF4v1!!#domaindefaultenablesystem#telnetserverenable//開啟telnet功能#vlan1#radiusscheme//創(chuàng)建radius服務器名稱primaryauthentication//配置主備radius服務器地址primaryaccountingsecondaryauthenticationsecondaryaccountingkeyauthenticationbluefox//配置radius服務器認證keyuser-name-formatwithout-domain//默認是without-domainnas-ipdomainsystemauthenticationloginradius-schemelocal//優(yōu)先調用名為radius服務器，然后localauthorizationloginradius-schemelocalaccess-limitdisablestateactiveidle-cutdisableself-service-urldisable#user-groupsystem#local-userbluefoxpasswordcipherllX$V%+*7&'Q=AQ'MAF4vl!!service-typesshtelnetterminal#interfaceNULL0#interfaceVlan-interfacelipaddressl92.l68.l.l#interfaceEthernetl/0/lportlink-modebridge#user-interfaceaux0authentication-modepassworduserprivilegelevellsetauthenticationpasswordcipher11X$V%+*7&'Q=AQ'MAF4v1!!user-interfacevty04authentication-modescheme//認證模式AAA還有password模式，要使用setpassword命令userprivilegelevel1 //配置user等級1RADIUS認證服務器配置：NetworkConfiguration添加用戶Select5haredProfileComponentsNetworkConfiquration勺SystemjConfigurationf=lIInterfaceConfigurationUserSetupRADIUS認證服務器配置：NetworkConfiguration添加用戶Select5haredProfileComponentsNetworkConfiquration勺SystemjConfigurationf=lIInterfaceConfigurationUserSetupAAAClients 第AAAClientHostnameAAAClientIPAddressAuthenticateUsing駟1RADIUS(IETF)AddEntryReportsandActivity■qAAAServers 卑|AAAServerNameAAAServerIPAddressAAAServerTypeVServer2192.168.1.2RADIUSAddEntryISearch上圖為radius服務器AAAClientSetupFor

swlAAAClientIPAddressKeyAuthenticateUsing圖為radius服務器key配置認證過程思想：用戶f查詢用戶屬于哪個group—得知domain—根據(jù)domain要求flocal、noneIRadius、hwtacacs如下：domainadminaccess-limitdisablestateactiveidle-cutdisableself-service-urldisabledomainsystemauthenticationloginradius-schemelocal//使用radius服務器認證，然后再local

認證authorizationloginradius-schemelocal查詢用戶在哪個組使用dislocal-user[H3C]displaylocal-userThecontentsoflocaluseradmin:State:ServiceType:Access-limit:ActiveNoneDisableCurrentAccessNum:0User-group:Bindattributes:Authorizationattributes:aHHThecontentsoflocaluserbluefox:State:ActiveServiceType:ssh/telnet/terminalAccess-limit:DisableCurrentAccessNum:0User-group:Bindattributes:Authorizationattributes:a|BThecontentsoflocaluserddd:State:ActiveServiceType:NoneAccess-limit:DisableCurrentAccessNum:0User-group:systemBindattributes