33-20z If you adopt the local RADIUS server function, the UDP port number of theauthentication/authorization server must be 1645, the UDP port number of the accounting servermust be 1646, and the IP addresses of the servers must be set to the addresses of this switch.z The message encryption key set by the local-server nas-ip ip-address key password commandmust be identical with the authentication/authorization message encryption key set by the keyauthentication command in the RADIUS scheme view of the RADIUS scheme on the specifiedNAS that uses this switch as its authentication server.z The switch supports IP addresses and shared keys for up to 16 network access servers (NAS).That is, when acting as the local RADIUS server, the switch can provide authentication service toup to 16 network access servers (including the switch itself) at the same time.z When acting as the local RADIUS server, the switch does not support EAP authentication (that isyou cannot set the 802.1x authentication method as eap by using the dot1xauthentication-method eap command).Configuring Timers for RADIUS ServersAfter sending out a RADIUS request (authentication/authorization request or accounting request) to aRADIUS server, the switch waits for a response from the server. The maximum time that the switch canwait for the response is called the response timeout time of RADIUS servers, and the correspondingtimer in the switch system is called the response timeout timer of RADIUS servers. If the switch gets noanswer within the response timeout time, it needs to retransmit the request to ensure that the user canobtain RADIUS service.For the primary and secondary servers (authentication/authorization servers, or accounting servers) ina RADIUS scheme:When the switch fails to communicate with the primary server due to some server trouble, the switch willturn to the secondary server and exchange messages with the secondary server.After the primary server remains in the block state for a specific time (set by the timer quiet command),the switch will try to communicate with the primary server again when it has a RADIUS request. If it findsthat the primary server has recovered, the switch immediately restores the communication with theprimary server instead of communicating with the secondary server, and at the same time restores thestatus of the primary server to active while keeping the status of the secondary server unchanged.To control the interval at which users are charged in real time, you can set the real-time accountinginterval. After the setting, the switch periodically sends online users' accounting information to RADIUSserver at the set interval.Follow these steps to set timers for RADIUS servers:To do… Use the command… RemarksEnter system view —system-viewRequiredCreate a RADIUS scheme andenter its viewradius schemeradius-scheme-name By default, a RADIUS schemenamed "system" has alreadybeen created in the system.
