HP procurve 2500 Manuale Utente
114
Enhancements in Release F.04.08
Configuring RADIUS Authentication and Accounting
For local authentication, the switch uses the Operator-level and Manager-level username/password
set(s) previously configured locally on the switch. (These are the usernames and passwords you can
configure using the CLI password command, the Web browser interface, or the menu interface—
which enables only local password configuration).
set(s) previously configured locally on the switch. (These are the usernames and passwords you can
configure using the CLI password command, the Web browser interface, or the menu interface—
which enables only local password configuration).
■
If the operator at the requesting terminal correctly enters the username/password pair for
either access level (Operator or Manager), access is granted on the basis of which username/
password pair was used. For example, suppose you configure Telnet primary access for
RADIUS and Telnet secondary access for local. If a RADIUS access attempt fails, then you
can still get access to either the Operator or Manager level of the switch by entering the
correct username/password pair for the level you want to enter.
either access level (Operator or Manager), access is granted on the basis of which username/
password pair was used. For example, suppose you configure Telnet primary access for
RADIUS and Telnet secondary access for local. If a RADIUS access attempt fails, then you
can still get access to either the Operator or Manager level of the switch by entering the
correct username/password pair for the level you want to enter.
■
If the username/password pair entered at the requesting terminal does not match either local
username/password pair previously configured in the switch, access is denied. In this case,
the terminal is again prompted to enter a username/password pair. In the default configura-
tion, the switch allows up to three attempts. If the requesting terminal exhausts the attempt
limit without a successful authentication, the login session is terminated and the operator
at the requesting terminal must initiate a new session before trying again.
username/password pair previously configured in the switch, access is denied. In this case,
the terminal is again prompted to enter a username/password pair. In the default configura-
tion, the switch allows up to three attempts. If the requesting terminal exhausts the attempt
limit without a successful authentication, the login session is terminated and the operator
at the requesting terminal must initiate a new session before trying again.
Controlling Web Browser Interface Access When Using RADIUS Authentication
Configuring the switch for RADIUS authentication does not affect Web browser interface access. To
prevent unauthorized access through the Web browser interface, do one or more of the following:
prevent unauthorized access through the Web browser interface, do one or more of the following:
■
Configure local authentication (a Manager user name and password and, optionally, an
Operator user name and password) on the switch.
Operator user name and password) on the switch.
■
Configure the switch’s Authorized IP Manager feature to allow Web browser access only
from authorized management stations. (The Authorized IP Manager feature does not inter-
fere with TACACS+ operation.)
from authorized management stations. (The Authorized IP Manager feature does not inter-
fere with TACACS+ operation.)
■
Disable Web browser access to the switch.
Configuring RADIUS Accounting
RADIUS Accounting Commands
[no] radius-server host < ip-address >
[ acct-port < port-number >]
[key < key-string >]
[no] aaa accounting < exec | network | system >
< start-stop | stop-only> radius
< start-stop | stop-only> radius
page 120