Configuring an HWTACACS ServerTemplate

Context

When configuring an HWTACACS server template, you must specify the IP address, port number, and shared key of a specified HWTACACS server. Other settings, such as the HWTACACS user name format and traffic unit, have default values and can be modified based on network requirements.

The HWTACACS server template settings such as the HWTACACS user name format and shared key must be the same as those on the HWTACACS server.

Procedure

Run system-view
The system view is displayed.
Run haca enable
HWTACACS is enabled.

By default, HWTACACS is enabled.
Run hwtacacs-server templatetemplate-name
An HWTACACS server template is created and the HWTACACS server template view is displayed.

By default, no HWTACACS server template is created on the device.

Configure HWTACACS authentication, authorization, and accounting servers.

IPv4 and IPv6 servers are configured at the same time in the same HWTACACS server template. The order for selecting servers is as follows: primary IPv4 server -> primary IPv6 server -> second secondary IPv4 server -> second secondary IPv6 server -> third secondary IPv4 server -> third secondary IPv6 server -> fourth secondary IPv4 server -> fourth secondary IPv6 server.

Configuration	Command	Description
Configure an HWTACACS authentication server.	hwtacacs-server authentication { ipv4-address \| ipv6-address } [ port ] [ public-net \| vpn-instance vpn-instance-name ] [ secondary \| third \| fourth ]	By default, no HWTACACS authentication server is configured.
Configure an HWTACACS authorization server.	hwtacacs-server authorization { ipv4-address \| ipv6-address } [ port ] [ public-net \| vpn-instance vpn-instance-name ] [ secondary \| third \| fourth ]	By default, no HWTACACS authorization server is configured.
Configure an HWTACACS accounting server.	hwtacacs-server accounting { ipv4-address \| ipv6-address } [ port ] [ public-net \| vpn-instance vpn-instance-name ] [ secondary \| third \| fourth ]	By default, no HWTACACS accounting server is configured.

Set parameters for interconnection between the device and an HWTACACS server.

Procedure	Command	Description
Set the shared key for the HWTACACS server.	hwtacacs-server shared-key cipher key-string	By default, no shared key is set for an HWTACACS server.
(Optional) Configure the format of the user name in the packet sent by the device to the HWTACACS server.	Configure the user name to contain the domain name: hwtacacs-server user-name domain-included Configure the original user name: hwtacacs-server user-name original Configure the user name not to contain the domain name: undo hwtacacs-server user-name domain-included	By default, the device does not change the user name entered by the user when sending packets to the HWTACACS server.
(Optional) Set the HWTACACS traffic unit.	hwtacacs-server traffic-unit { byte \| kbyte \| mbyte \| gbyte }	The default HWTACACS traffic unit on the device is bytes.
(Optional) Set the source IP address for communication between the device and HWTACACS server.	hwtacacs-server source-ip { ip-address \| source-loopback interface- number \| source-vlanif interface- number } Or hwtacacs-server source-ipv6 { ipv6-address \| source-loopback interface-number \| ipv6 source-vlanif interface- number }	By default, the device uses the IP address of the actual outbound interface as the source IP address encapsulated in HWTACACS packets.

(Optional) Set the response timeout interval and activation interval for the HWTACACS server.

Procedure	Command	Description
Set the response timeout interval for the HWTACACS server.	hwtacacs-server timer response-timeout interval	The default response timeout interval for an HWTACACS server is 5 seconds. If the device does not receive a response from an HWTACACS server within the response timeout interval, it considers that the HWTACACS server is unavailable. The device then attempts to use other authentication and authorization methods.
Set the interval at which the primary HWTACACS server restores to the active state.	hwtacacs-server timer quiet interval	The default interval at which the primary HWTACACS server restores to the active state is 5 minutes.

Procedure

Command

Description

Set the response timeout interval for the HWTACACS server.

hwtacacs-server timer response-timeout interval

The default response timeout interval for an HWTACACS server is 5 seconds.

If the device does not receive a response from an HWTACACS server within the response timeout interval, it considers that the HWTACACS server is unavailable. The device then attempts to use other authentication and authorization methods.

Set the interval at which the primary HWTACACS server restores to the active state.

hwtacacs-server timer quiet interval

The default interval at which the primary HWTACACS server restores to the active state is 5 minutes.

(Optional) Run hwtacacs-server authentication user-name in-authentication-start
The device is configured to encapsulate the user name in the Authentication-Start packets of administrators.

By default, the Authentication-Start packets of administrators do not carry the user name.

This function takes effect only for administrators.
Run quit
The system view is displayed.
(Optional) Run hwtacacs-server accounting-stop-packetresend { disable | enable number }
The function of retransmitting Accounting-Stop packets is configured.

By default, the function of retransmitting Accounting-Stop packets is enabled and the number of retransmissions is 100.
Run return
The user view is displayed.
(Optional) Run hwtacacs-user change-password hwtacacs-servertemplate-name
The password saved on the HWTACACS server is changed.

To ensure device security, you are advised to frequently change the password.