H3C认证服务器radius 冗余备份

H3C认证服务器冗余备份如图：client1、client2分别是radius主备服务器，做认证服务器冗余备份。LSW1为H3CS3610三层交换机交换机S3610配置如下：<H3C>displaycurrent-configuration#version5.20,Release5309#sysnameH3C#superpasswordlevel2cipher11X$V%+*7&'Q=aQ'MAF4v1!!/配置super密码superpasswordlevel3cipher11X$V%+*7&'Q=aQ'MAF4v1!!#domaindefaultenablesystem#telnetserverenable//开启telnet功能#vlan1#radiusscheme//创建radius服务器名称primaryauthentication//配置主备radius服务器地址primaryaccountingsecondaryauthenticationsecondaryaccountingkeyauthenticationbluefox//配置radius服务器认证keyuser-name-formatwithout-domain//默认是without-domainnas-ipdomainsystemauthenticationloginradius-schemelocal//优先调用名为radius服务器，然后localauthorizationloginradius-schemelocalaccess-limitdisablestateactiveidle-cutdisableself-service-urldisable#user-groupsystem#local-userbluefoxpasswordcipherllX$V%+*7&'Q=AQ'MAF4vl!!service-typesshtelnetterminal#interfaceNULL0#interfaceVlan-interfacelipaddressl92.l68.l.l#interfaceEthernetl/0/lportlink-modebridge#user-interfaceaux0authentication-modepassworduserprivilegelevellsetauthenticationpasswordcipher11X$V%+*7&'Q=AQ'MAF4v1!!user-interfacevty04authentication-modescheme//认证模式AAA还有password模式，要使用setpassword命令userprivilegelevel1 //配置user等级1RADIUS认证服务器配置：NetworkConfiguration添加用户Select5haredProfileComponentsNetworkConfiquration勺SystemjConfigurationf=lIInterfaceConfigurationUserSetupRADIUS认证服务器配置：NetworkConfiguration添加用户Select5haredProfileComponentsNetworkConfiquration勺SystemjConfigurationf=lIInterfaceConfigurationUserSetupAAAClients 第AAAClientHostnameAAAClientIPAddressAuthenticateUsing驷1RADIUS(IETF)AddEntryReportsandActivity■qAAAServers 卑|AAAServerNameAAAServerIPAddressAAAServerTypeVServer2192.168.1.2RADIUSAddEntryISearch上图为radius服务器AAAClientSetupFor

swlAAAClientIPAddressKeyAuthenticateUsing图为radius服务器key配置认证过程思想：用户f查询用户属于哪个group—得知domain—根据domain要求flocal、noneIRadius、hwtacacs如下：domainadminaccess-limitdisablestateactiveidle-cutdisableself-service-urldisabledomainsystemauthenticationloginradius-schemelocal//使用radius服务器认证，然后再local

认证authorizationloginradius-schemelocal查询用户在哪个组使用dislocal-user[H3C]displaylocal-userThecontentsoflocaluseradmin:State:ServiceType:Access-limit:ActiveNoneDisableCurrentAccessNum:0User-group:Bindattributes:Authorizationattributes:aHHThecontentsoflocaluserbluefox:State:ActiveServiceType:ssh/telnet/terminalAccess-limit:DisableCurrentAccessNum:0User-group:Bindattributes:Authorizationattributes:a|BThecontentsoflocaluserddd:State:ActiveServiceType:NoneAccess-limit:DisableCurrentAccessNum:0User-group:systemBindattributes