H3C Technologies H3C SecPath F1000-E - Manual (Page 216)

206
Step Command Remarks
2. Enter HWTACACS scheme
view. hwtacacs scheme
hwtacacs-scheme-name
N/A
3. Set the format of usernames
sent to the HWTACACS
servers.
user-name-format { keep-original |
with-domain | without-domain }
Optional.
By default, the ISP domain name
is included in a username.
4. Specify the unit for data flows
or packets sent to the
HWTACACS servers.
data-flow-format { data { byte |
giga-byte | kilo-byte | mega-byte }
| packet { giga-packet | kilo-packet
| mega-packet | one-packet } }*
Optional.
The default unit is byte for data
flows and one-packet for data
packets.
Specifying a source IP address for outgoing HWTACACS packets
The source IP address of HWTACACS packets that a NAS sends must match the IP address of the NAS
configured on the HWTACACS server. An HWTACACS server identifies a NAS by IP address. Upon
receiving an HWTACACS packet, an HWTACACS server checks whether the source IP address of the
packet is the IP address of any managed NAS. If yes, the server processes the packet. If not, the server
drops the packet.
Usually, the source address of outgoing HWTACACS packets can be the IP address of any interface that
the NAS can use to communicate with the HWTACACS server. In some special scenarios, however, you
must change the source IP address. For example, if a NAT device is present between the NAS and the
HWTACACS server, the source IP address of outgoing HWTACACS packets must be a public IP address
of the NAS. If the NAS is configured with VRRP for stateful failover, the source IP address of HWTACACS
packets can be the virtual IP address of the VRRP group to which the uplink belongs.
You can specify the source IP address for outgoing HWTACACS packets in HWTACACS scheme view for
a specific HWTACACS scheme, or in system view for all HWTACACS schemes whose servers are in a
VPN or the public network.
Before sending an HWTACACS packet, a NAS selects a source IP address in this order:
• The source IP address specified for the HWTACACS scheme.
• The source IP address specified in system view for the VPN or public network, depending on where
the HWTACACS server resides.
• The IP address of the outbound interface specified by the route.
To specify a source IP address for all HWTACACS schemes of a VPN or the public network:
Step Command Remarks
1. Enter system view. system-view N/A
2. Specify a source IP address
for outgoing HWTACACS
packets.
hwtacacs nas-ip ip-address
[ vpn-instance vpn-instance-name ]
By default, the IP address of the
outbound interface is used as the
source IP address.
To specify a source IP address for a specific HWTACACS scheme:
Step Command Remarks
1. Enter system view. system-view N/A