Operation Manual – AAA & RADIUS & HWTACACS & EADH3C S7500 Series Ethernet SwitchesChapter 1 AAA & RADIUS & HWTACACSConfiguration1-36Caution:z The primary and secondary accounting servers cannot use the same IP address.Otherwise, the system will prompt unsuccessful configuration.z You can remove a server only when it is not being used by any active TCPconnection for sending accounting packets.z Currently, HWTACACS does not support the accounting of FTP users.1.5.5 Configuring Shared Keys for HWTACACS PacketsWhen using a TACACS server as an AAA server, you can set a key to improve thecommunication security between the router and the TACACS server.The TACACS client (device system) and server adopt MD5 algorithm to encrypt theexchanged HWTACACS packets. The two parties verify the validity of the exchangedpackets by using the shared keys that have been set on them, and can accept andrespond to the packets sent from each other only if both of them have the same sharedkeys. Therefore, make sure the shared key set on the device and that on TACACSserver are the same.Table 1-27 Configure shared keys for HWTACACS packetsTo do... Use the command... RemarksEnter system view system-view —Create a HWTACACSscheme and enter its viewhwtacacs schemehwtacacs-scheme-nameRequiredBy default, noHWTACACS schemeexists.Set a shared key for theHWTACACSaccounting/authentication/authorization packetskey { accounting |authorization |authentication } stringRequiredBy default, the TACACSserver does not have akey.
