H3C認(rèn)證服務(wù)器冗余備份如圖：client1、client2分別是radius主備服務(wù)器，做認(rèn)證服務(wù)器冗余備份。LSW1為H3CS3610三層交換機(jī)交換機(jī)S3610配置如下：<H3C>displaycurrent-configuration#version5.20,Release5309#sysnameH3C#superpasswordlevel2cipher11X$V%+*7&'Q=aQ'MAF4v1!!/配置super密碼superpasswordlevel3cipher11X$V%+*7&'Q=aQ'MAF4v1!!#domaindefaultenablesystem#telnetserverenable//開啟telnet功能#vlan1#radiusscheme//創(chuàng)建radius服務(wù)器名稱primaryauthentication//配置主備radius服務(wù)器地址primaryaccountingsecondaryauthenticationsecondaryaccountingkeyauthenticationbluefox//配置radius服務(wù)器認(rèn)證keyuser-name-formatwithout-domain//默認(rèn)是without-domainnas-ipdomainsystemauthenticationloginradius-schemelocal//優(yōu)先調(diào)用名為radius服務(wù)器，然后localauthorizationloginradius-schemelocalaccess-limitdisablestateactiveidle-cutdisableself-service-urldisable#user-groupsystem#local-userbluefoxpasswordcipherllX$V%+*7&'Q=AQ'MAF4vl!!service-typesshtelnetterminal#interfaceNULL0#interfaceVlan-interfacelipaddressl92.l68.l.l#interfaceEthernetl/0/lportlink-modebridge#user-interfaceaux0authentication-modepassworduserprivilegelevellsetauthenticationpasswordcipher11X$V%+*7&'Q=AQ'MAF4v1!!user-interfacevty04authentication-modescheme//認(rèn)證模式AAA還有password模式，要使用setpassword命令userprivilegelevel1 //配置user等級(jí)1RADIUS認(rèn)證服務(wù)器配置：NetworkConfiguration添加用戶Select5haredProfileComponentsNetworkConfiquration勺SystemjConfigurationf=lIInterfaceConfigurationUserSetupRADIUS認(rèn)證服務(wù)器配置：NetworkConfiguration添加用戶Select5haredProfileComponentsNetworkConfiquration勺SystemjConfigurationf=lIInterfaceConfigurationUserSetupAAAClients 第AAAClientHostnameAAAClientIPAddressAuthenticateUsing駟1RADIUS(IETF)AddEntryReportsandActivity■qAAAServers 卑|AAAServerNameAAAServerIPAddressAAAServerTypeVServer2192.168.1.2RADIUSAddEntryISearch上圖為radius服務(wù)器AAAClientSetupFor

swlAAAClientIPAddressKeyAuthenticateUsing圖為radius服務(wù)器key配置認(rèn)證過(guò)程思想：用戶f查詢用戶屬于哪個(gè)group—得知domain—根據(jù)domain要求flocal、noneIRadius、hwtacacs如下：domainadminaccess-limitdisablestateactiveidle-cutdisableself-service-urldisabledomainsystemauthenticationloginradius-schemelocal//使用radius服務(wù)器認(rèn)證，然后再local

認(rèn)證authorizationloginradius-schemelocal查詢用戶在哪個(gè)組使用dislocal-user[H3C]displaylocal-userThecontentsoflocaluseradmin:State:ServiceType:Access-limit:ActiveNoneDisableCurrentAccessNum:0User-group:Bindattributes:Authorizationattributes:aHHThecontentsoflocaluserbluefox:State:ActiveServiceType:ssh/telnet/terminalAccess-limit:DisableCurrentAccessNum:0User-group:Bindattributes:Authorizationattributes:a|BThecontentsoflocaluserddd:State:ActiveServiceType:NoneAccess-limit:DisableCurrentAccessNum:0User-group:systemBindattributes