H12-811_V2.0 practice question 14 of 15

R1 has the following configurations: [R1] radius-server template 1 [R1-radius-1] radius-server authentication 10.1.6.6 1812 [R1-radius-1]…

R1 has the following configurations: [R1] radius-server template 1 [R1-radius-1] radius-server authentication 10.1.6.6 1812 [R1-radius-1] radius-server accounting 10.1.6.6 1813 [R1-radius-1] radius-server shared-key cipher YsHsjx_202206139 [R1-radius-1] quit [R1] aaa [R1-aaa] authentication-scheme auth1 [R1-aaa-authen-auth1] authentication-mode radius [R1-aaa-authen-auth1] quit [R1-aaa] accounting-scheme acc1 [R1-aaa-accounting-acc1] accounting-mode radius [R1-aaa-accounting-acc1] quit [R1-aaa] domain huawei.com [R1-aaa-domain-huawei.com] authentication-scheme auth1 [R1-aaa-domain-huawei.com] accounting-scheme acc1 [R1-aaa-domain-huawei.com] radius-server 1 [R1-aaa-domain-huawei.com] quit [R1-aaa] quit Which of the following statements is true?

Answer options

A: RADIUS does not support accounting. Even if an accounting server is specified in the RADIUS server template, accounting cannot be performed when terminals access the network.

B: The user cannot obtain authorization information after being authenticated because the IP address of the authorization server is not configured in the RADIUS server template.

C: When a terminal initiates an authentication request, R1 needs to first establish a TCP connection with the server whose IP address is 10.1.6.6.

D: When a terminal uses the user name [email protected] to initiate authentication, RADIUS authentication is used. Correct answer

Correct Answer:

D. When a terminal uses the user name [email protected] to initiate authentication, RADIUS authentication is used.

Explanation

The configuration establishes a domain named huawei.com. When a user provides a username in the format user@domain, the device uses the AAA configuration specific to that domain. Here, [email protected] matches the huawei.com domain. This domain is configured to use authentication-scheme auth1, which in turn is set to authentication-mode radius. Therefore, the authentication request will be processed using the RADIUS protocol and sent to the configured RADIUS server.

Why Incorrect

A. RADIUS protocol explicitly supports accounting functions. The configuration correctly specifies an accounting server on UDP port 1813, which is the standard port for RADIUS accounting.
B. RADIUS combines authentication and authorization. The RADIUS server sends authorization information within the Access-Accept packet. A separate authorization server configuration is not required.
C. The RADIUS protocol operates over UDP, not TCP. The standard ports are UDP/1812 for authentication and UDP/1813 for accounting, as configured in the template.

References

1. Huawei HedEx Documentation for VRP V800R012C10

Configuration Guide - Security

Section: "AAA Configuration -> Configuring a RADIUS Server Template". This section details how to configure RADIUS servers for authentication and accounting.

2. Huawei HedEx Documentation for VRP V800R012C10

Configuration Guide - Security

Section: "AAA Configuration -> Configuring a Domain". This section explains how usernames containing a domain name are mapped to a specific domain's AAA policies.

3. RFC 2865

"Remote Authentication Dial In User Service (RADIUS)"

Section 3. This RFC specifies that RADIUS runs over UDP.

Keep practicing

Take the free H12-811_V2.0 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test