HWTACACS configuration on Huawei device

Lets look at a typical configuration of HWTACACS server on Huawei device:

#
hwtacacs-server template labnario
hwtacacs-server authentication 172.16.10.1
hwtacacs-server authorization 172.16.10.1
hwtacacs-server accounting 172.16.10.1
hwtacacs-server source-ip 172.16.10.10
hwtacacs-server shared-key cipher %$%$;XioR#N`7=~][vLDTr2S(2.#%$%$
undo hwtacacs-server user-name domain-included
#
aaa
authentication-scheme hwtacacs
authentication-mode hwtacacs local
authorization-scheme hwtacacs
authorization-mode hwtacacs local
accounting-scheme hwtacacs
accounting-mode hwtacacs
domain default_admin
authentication-scheme hwtacacs
accounting-scheme hwtacacs
authorization-scheme hwtacacs
hwtacacs-server labnario
local-user labnario password cipher %$%$'3N&Y#>c>Ibb;f:!o4mW(7#h%$%$
local-user labnario privilege level 15
local-user labnario service-type telnet terminal ssh ftp
#
user-interface vty 0 4
authentication-mode aaa

What do we have to do to configure HWTACACS AAA?

Configure an HWTACACS server template.

Configure authentication, authorization, and accounting schemes.
Apply the HWTACACS server template, authentication scheme, authorization scheme,
and accounting scheme to the domain.

To ensure redundancy we can configure secondary HWTACAC server:

#
hwtacacs-server template labnario
hwtacacs-server authentication 172.16.11.1 secondary
hwtacacs-server authorization 172.16.11.1 secondary
hwtacacs-server accounting 172.16.11.1 secondary

In such case, if primary server is not available, secondary server is used.

Lets look at AAA schemes. As you can see the there are backups for authentication and
authorization. If HWTACAC authentication fails, local authentication is used. We have the
same situation for HWTACAC authorization.

But what happens if accounting fails?

There is not possible to configure backup for accounting. We have 3 options: HWTACAC,
local or RADIUS. But only one of them can be selected.
Lets assume that you use accounting like in the configuration above. After an accounting
scheme is applied, if a user goes online, the device sends an accounting-start packet to an
accounting server. When the network is working properly, the accounting server responds to
the accounting-start packet. If a fault occurs in the network, the device may not receive the
response packet from the accounting server. As a result, accounting fails. Finally, when you
are trying to log in as local user labnario, you are immediately disconnected with information:

The connection was closed by the remote host.

Of course there is a way out of this situation by using accounting start-fail online
command.

The final backup configuration of AAA should look like:

#
aaa
authentication-scheme hwtacacs
authentication-mode hwtacacs local
authorization-scheme hwtacacs
authorization-mode hwtacacs local
accounting-scheme hwtacacs
accounting-mode hwtacacs
accounting start-fail online