Login
- Table of Contents
-
- H3C WX3000 Series Unified Switches Switching Engine Configuration Guide-6W103
- 00-Preface
- 01-CLI Configuration
- 02-Login Configuration
- 03-Configuration File Management Configuration
- 04-VLAN Configuration
- 05-Auto Detect Configuration
- 06-Voice VLAN Configuration
- 07-GVRP Configuration
- 08-Basic Port Configuration
- 09-Link Aggregation Configuration
- 10-Port Isolation Configuration
- 11-Port Security-Port Binding Configuration
- 12-DLDP Configuration
- 13-MAC Address Table Management Configuration
- 14-MSTP Configuration
- 15-802.1x and System Guard Configuration
- 16-AAA Configuration
- 17-MAC Address Authentication Configuration
- 18-IP Address and Performance Configuration
- 19-DHCP Configuration
- 20-ACL Configuration
- 21-QoS-QoS Profile Configuration
- 22-Mirroring Configuration
- 23-ARP Configuration
- 24-SNMP-RMON Configuration
- 25-Multicast Configuration
- 26-NTP Configuration
- 27-SSH Configuration
- 28-File System Management Configuration
- 29-FTP-SFTP-TFTP Configuration
- 30-Information Center Configuration
- 31-System Maintenance and Debugging Configuration
- 32-VLAN-VPN Configuration
- 33-HWPing Configuration
- 34-DNS Configuration
- 35-Smart Link-Monitor Link Configuration
- 36-PoE-PoE Profile Configuration
- 37-Routing Protocol Configuration
- 38-UDP Helper Configuration
- 39-Acronyms
- 40-Index
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 17-MAC Address Authentication Configuration | 82.99 KB |
Table of Contents
1 MAC Authentication Configuration
Performing MAC Authentication on a RADIUS Server
Performing MAC Authentication Locally
Configuring Basic MAC Authentication Functions
MAC Address Authentication Enhanced Function Configuration
MAC Address Authentication Enhanced Function Configuration Tasks
Configuring the Maximum Number of MAC Address Authentication Users Allowed to Access a Port
Displaying and Maintaining MAC Authentication
MAC Authentication Configuration Example
The sample output information in this manual was created on the WX3024. The output information on your device may vary.
MAC Authentication Overview
MAC authentication provides a way for authenticating users based on ports and MAC addresses, without requiring any client software to be installed on the hosts. Once detecting a new MAC address, it initiates the authentication process. During authentication, the user does not need to enter username or password manually.
The device implements MAC authentication locally or on a RADIUS server.
After determining the authentication method, users can select one of the following types of username as required:
l MAC address mode, where the MAC address of a user serves as both the username and the password.
l Fixed mode, where usernames and passwords are configured on the device in advance. In this case, the username, the password, and the limits on the total number of usernames are the matching criterion for successful authentication. For details, refer to AAA in H3C WX3000 Series Unified Switches Switching Engine Configuration Guide for information about local user attributes.
Performing MAC Authentication on a RADIUS Server
In RADIUS-based MAC authentication, the device serves as a RADIUS client and completes MAC authentication in combination of the RADIUS server.
l If the type of username is MAC address, the device sends a detected MAC address to the RADIUS server as both the username and password for authentication of the user.
l If the type of username is fixed username, the device sends the same username and password previously configured on the device to the RADIUS server for authentication of each user.
A user can access a network upon passing the authentication performed by the RADIUS server.
Performing MAC Authentication Locally
In local MAC authentication, the device performs authentication for users locally and different items need to be manually configured for users on the device according to the specified type of username:
l If the username type is MAC address, a local user must be configured for each user on the device, using the MAC address of the accessing user as the username. Hyphens must or must not be included depending on the format configured with the mac-authentication authmode usernameasmacaddress usernameformat command; otherwise, the authentication will fail.
l If the username type is fixed username, you need to configure the fixed username and password on the device, which are used by the device to authenticate all users.
The service type of a local user needs to be configured as lan-access.
Related Concepts
MAC Authentication Timers
The following timers function in the process of MAC authentication:
l Offline detect timer: At this interval, the device checks to see whether an online user has gone offline. Once detecting that a user becomes offline, the device sends a stop-accounting notice to the RADIUS server.
l Quiet timer: Whenever a user fails MAC authentication, the device does not initiate any MAC authentication of the user during a period defined by this timer.
l Server timeout timer: During authentication of a user, if the device receives no response from the RADIUS server in this period, it assumes that its connection to the RADIUS server has timed out and forbids the user from accessing the network.
Quiet MAC Address
When a user fails MAC authentication, the MAC address becomes a quiet MAC address, which means that any packets from the MAC address will be discarded simply by the device until the quiet timer expires. This prevents an invalid user from being authenticated repeatedly in a short time.
If the quiet MAC is the same as the static MAC configured or an authentication-passed MAC, then the quiet function is not effective.
Configuring Basic MAC Authentication Functions
Follow these steps to configure basic MAC authentication functions:
|
To do… |
Use the command… |
Remarks |
||
|
Enter system view |
system-view |
— |
||
|
Enable MAC authentication globally |
mac-authentication |
Required Disabled by default |
||
|
Enable MAC authentication for the specified port(s) or the current port |
In system view |
mac-authentication interface interface-list |
Use either method Disabled by default |
|
|
In interface view |
interface interface-type interface-number |
|||
|
mac-authentication |
||||
|
quit |
||||
|
Set the username in MAC address mode for MAC authentication |
mac-authentication authmode usernameasmacaddress [ usernameformat { with-hyphen | without-hyphen } { lowercase | uppercase } | fixedpassword password ] |
Optional By default, the MAC address of a user is used as the username. |
||
|
Set the username in fixed mode for MAC authentication |
Set the username in fixed mode for MAC authentication |
mac-authentication authmode usernamefixed |
Optional By default, the username is “mac” and no password is configured. |
|
|
Configure the username |
mac-authentication authusername username |
|||
|
Configure the password |
mac-authentication authpassword password |
|||
|
Specify an ISP domain for MAC authentication |
mac-authentication domain isp-name |
Required The default ISP domain (default domain) is used by default. |
||
|
Configure the MAC authentication timers |
mac-authentication timer { offline-detect offline-detect-value | quiet quiet-value | server-timeout server-timeout-value } |
Optional The default timeout values are as follows: 300 seconds for offline detect timer; 60 seconds for quiet timer; and 100 seconds for server timeout timer |
||
l If MAC authentication is enabled on a port, you cannot configure the maximum number of dynamic MAC address entries for that port (through the mac-address max-mac-count command), and vice versa.
l If MAC authentication is enabled on a port, you cannot configure port security (through the port-security enable command) on that port, and vice versa.
l You can configure MAC authentication on a port before enabling it globally. However, the configuration will not take effect unless MAC authentication is enabled globally.
MAC Address Authentication Enhanced Function Configuration
MAC Address Authentication Enhanced Function Configuration Tasks
Complete the following tasks to configure MAC address authentication enhanced function:
|
Task |
Remarks |
|
Optional |
|
|
Configuring the Maximum Number of MAC Address Authentication Users Allowed to Access a Port |
Optional |
Configuring a Guest VLAN
Different from Guest VLANs described in the 802.1x and System-Guard manual, Guest VLANs mentioned in this section refer to Guests VLANs dedicated to MAC address authentication.
After completing configuration tasks in Configuring Basic MAC Authentication Functions for the device, the device can authenticate access users according to their MAC addresses or according to fixed usernames and passwords. The device will not learn MAC addresses of the clients failing in the authentication into its local MAC address table, thus prevent illegal users from accessing the network.
In some cases, if the clients failing in the authentication are required to access some restricted resources in the network (such as the virus library update server), you can use the Guest VLAN.
You can configure a Guest VLAN for each port of the device. When a client connected to a port fails in MAC address authentication, this port will be added into the Guest VLAN automatically. The MAC address of this client will also be learned into the MAC address table of the Guest VLAN, and thus the user can access the network resources of the Guest VLAN.
After a port is added to a Guest VLAN, the device will re-authenticate the first access user of this port (namely, the first user whose unicast MAC address is learned by the device) periodically. If this user passes the re-authentication, this port will exit the Guest VLAN, and thus the user can access the network normally.
l Guest VLANs are implemented in the mode of adding a port to a VLAN. For example, when multiple users are connected to a port, if the first user fails in the authentication, the other users can access only the contents of the Guest VLAN. The device will re-authenticate only the first user accessing this port, and the other users cannot be authenticated again. Thus, if more than one client is connected to a port, you cannot configure a Guest VLAN for this port.
l After users that are connected to an existing port failed to pass authentication, the device adds the port to the Guest VLAN. Therefore, the Guest VLAN can separate unauthenticated users on an access port. When it comes to a trunk port or a hybrid port, if a packet itself has a VLAN tag and be in the VLAN that the port allows to pass, the packet will be forwarded perfectly without the influence of the Guest VLAN. That is, packets can be forwarded to the VLANs other than the Guest VLAN through the trunk port and the hybrid port, even users fail to pass authentication.
Follow these steps to configure a Guest VLAN:
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Enter Ethernet port view |
interface interface-type interface-number |
— |
|
Configure the Guest VLAN for the current port |
mac-authentication guest-vlan vlan-id |
Required By default, no Guest VLAN is configured for a port by default. |
|
Return to system view |
quit |
— |
|
Configure the interval at which the device re-authenticates users in Guest VLANs |
mac-authentication timer guest-vlan-reauth interval |
Optional By default, the device re-authenticates the users in Guest VLANs at the interval of 30 seconds by default. |
l If more than one client is connected to a port, you cannot configure a Guest VLAN for this port.
l When a Guest VLAN is configured for a port, only one MAC address authentication user can access the port. Even if you set the limit on the number of MAC address authentication users to more than one, the configuration does not take effect.
l The undo vlan command cannot be used to remove the VLAN configured as a Guest VLAN. If you want to remove this VLAN, you must remove the Guest VLAN configuration for it. Refer to VLAN in H3C WX3000 Series Unified Switches Switching Engine Configuration Guide for the description on the undo vlan command.
l Only one Guest VLAN can be configured for a port, and the VLAN configured as the Guest VLAN must be an existing VLAN. Otherwise, the Guest VLAN configuration does not take effect. If you want to change the Guest VLAN for a port, you must remove the current Guest VLAN and then configure a new Guest VLAN for this port.
l 802.1x authentication cannot be enabled for a port configured with a Guest VLAN.
l The Guest VLAN function for MAC authentication does not take effect when port security is enabled.
Configuring the Maximum Number of MAC Address Authentication Users Allowed to Access a Port
You can configure the maximum number of MAC address authentication users for a port in order to control the maximum number of users accessing a port. After the number of access users has exceeded the configured maximum number, the device will not trigger MAC address authentication for subsequent access users, and thus these subsequent access users cannot access the network normally.
|
To do… |
Use the command… |
Remarks |
|
Enter system view |
system-view |
— |
|
Enter Ethernet port view |
interface interface-type interface-number |
— |
|
Configure the maximum number of MAC address authentication users allowed to access a port |
mac-authentication max-auth-num user-number |
Required By default, the maximum number of MAC address authentication users allowed to access a port is 256. |
l If both the limit on the number of MAC address authentication users and the limit on the number of users configured in the port security function are configured for a port, the smaller value of the two configured limits is adopted as the maximum number of MAC address authentication users allowed to access this port. Refer to Port Security in H3C WX3000 Series Unified Switches Switching Engine Configuration Guide for the description on the port security function.
l You cannot configure the maximum number of MAC address authentication users for a port if any user connected to this port is online.
Displaying and Maintaining MAC Authentication
|
To do… |
Use the command… |
Remarks |
|
Display global or on-port information about MAC authentication |
display mac-authentication [ interface interface-list ] |
Available in any view |
|
Clear the statistics of global or on-port MAC authentication |
reset mac-authentication statistics [ interface interface-type interface-number ] |
Available in user view |
MAC Authentication Configuration Example
Network requirements
As illustrated in Figure 1-1, a supplicant is connected to Switch through port GigabitEthernet 1/0/2.
l MAC authentication is required on port GigabitEthernet 1/0/2 to control user access to the Internet.
l All users belong to domain aabbcc.net. The authentication is performed locally and the MAC address of the PC (00-0d-88-f6-44-c1) is used as both the username and password.
Figure 1-1 Network diagram for MAC authentication configuration
Configuration Procedure
# Enable MAC authentication on port GigabitEthernet 1/0/2.
<device> system-view
[device] mac-authentication interface GigabitEthernet 1/0/2
# Specify to use the user MAC address as both the username and password for MAC authentication, and specify the MAC address format as hyphened lowercase MAC address.
[device] mac-authentication authmode usernameasmacaddress usernameformat with-hyphen lowercase
# Add a local user.
l Specify the username and password.
[device] local-user 00-0d-88-f6-44-c1
[device-luser-00-0d-88-f6-44-c1] password simple 00-0d-88-f6-44-c1
l Set the service type to “lan-access”.
[device-luser-00-0d-88-f6-44-c1] service-type lan-access
[device-luser-00-0d-88-f6-44-c1] quit
# Add an ISP domain named aabbcc.net.
[device] domain aabbcc.net
New Domain added.
# Specify to perform local authentication.
[device-isp-aabbcc.net] scheme local
[device-isp-aabbcc.net] quit
# Specify aabbcc.net as the ISP domain for MAC authentication
[device] mac-authentication domain aabbcc.net
# Enable MAC authentication globally (This is usually the last step in configuring access control related features. Otherwise, a user may be denied of access to the networks because of incomplete configuaration.)
[device] mac-authentication
After doing so, your MAC authentication configuration will take effect immediately. Only users with the MAC address of 00-0d-88-f6-44-c1 are allowed to access the Internet through port GigabitEthernet 1/0/2.
