Hi, everyone! Today I’m going to introduce how to deal with HWTACACS failed to set the response-timeout with 60 seconds.
[Issue]
we have authentication and authorization with HWTACACS ….. we want that if HWTACACS server not reachable for 60 seconds the device should allow local authentication.
In order to do that we wanted to configure the hwtacacs-server timer response-timeout with 60 seconds .
<Huawei> system-view
[Huawei] hwtacacs-server template test1
[Huawei-hwtacacs-test1] hwtacacs-server timer response-timeout 60
But if waiting for HWTACACS server for 60 seconds then after that local authentication is failing . If we reduce the HWTACACS response timeout to 10 seconds it is working fine.
[Analysis]
The default for response-timeout is 5 seconds :
Usage Scenario
After the device sends a request packet to the HWTACACS server, if the device does not receive any response packet from the server within the specified response timeout interval:
· If only one HWTACACS server is configured, the device does not retransmit the request to this server.
· If both active/standby HWTACACS servers are available and the TCP link between them works normally, the device retransmits the request to the standby server after timeout. If the TCP link is broken during the timeout interval, the device immediately retransmits the request to the standby server.
This improves reliability of HWTACACS authentication, authorization, and accounting.
After confirmation , since authentication and authorization configured So when if we configure the hwtacacs-server timer response-timeout 60 it means that authentication response-timeout 60 seconds and authorization response-timeout 60 seconds which is totally 120 seconds and this will exceed AAA timer which is 110 seconds .
The AAA process end at 110 seconds which is in SW code and can’t be changed .
[Root cause]
When configure the hwtacacs-server timer response-timeout 60 with authentication and authorization configured, it means that authentication response-timeout 60 seconds, authorization response-timeout 60seconds which is totally 120 seconds and this will exceed AAA timer 110 seconds and process will fail.
[Solution]
If we want 60 seconds timeout for all HWTACACS process ( include authentication and authorization), we suggest to set the response-timeout to 30 seconds .
<Huawei> system-view
[Huawei] hwtacacs-server template test1
[Huawei-hwtacacs-test1] hwtacacs-server timer response-timeout 30
Glad to help you! Any further questions, let us know.
