Login
- Table of Contents
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 04-MAC Authentication Commands | 67.79 KB |
Table of Contents
1 MAC Authentication Configuration Commands·
MAC Authentication Configuration Commands
mac-authentication user-name-format
reset mac-authentication statistics
l The models listed in this document are not applicable to all regions. Please consult your local sales office for the models applicable to your region.
l Support of the H3C WA series WLAN access points (APs) for commands may vary by AP model. For more information, see Feature Matrix.
l The interface types and the number of interfaces vary by AP model.
MAC Authentication Configuration Commands
display mac-authentication
Syntax
display mac-authentication [ interface interface-list ]
View
Any view
Default Level
2: System level
Parameters
interface interface-list: Specifies a port list, in the format of { interface-type interface-number [ to interface-type interface-number ] }&<1-10>, where &<1-10> indicates that you can specify up to 10 port ranges. The start port and end port of a port range must be of the same type and the end port number must be greater than the start port number. A port range defined without the to interface-type interface-number portion comprises only one port.
Description
Use the display mac-authentication command to display MAC authentication settings and statistics, including the global settings, and port-specific settings and MAC authentication and online user statistics.
If you specify a list of ports, the command displays port-specific settings and statistics only for the specified ports.
If you do not specify any port, the command displays port-specific settings and statistics for all ports.
Examples
# Display MAC authentication settings and statistics.
<Sysname> display mac-authentication
MAC address authentication is enabled.
User name format is MAC address, in lowercase like xxxxxxxxxxxx
Fixed username:mac
Fixed password:not configured
Offline detect period is 300s
Quiet period is 60s.
Server response timeout value is 100s
The max allowed user number is 128 per slot
Current user number amounts to 0
Current domain: not configured, use default domain
Silent Mac User info:
MAC ADDR From Port Port Index
GigabitEthernet1/0/1 is link-up
MAC address authentication is disabled
Authenticate success: 0, failed: 0
Max number of on-line users is 0
Current online user number is 0
MAC ADDR Authenticate state AuthIndex
GigabitEthernet1/0/2 is link-down
MAC address authentication is disabled
Authenticate success: 0, failed: 0
Max number of on-line users is 0
Current online user number is 0
MAC Addr Authenticate State Auth Index
WLAN-BSS32 is link-down
MAC address authentication is disabled
Authenticate success: 0, failed: 0
Max number of on-line users is 0
Current online user number is 0
MAC Addr Authenticate State Auth Index
……(part of the output omitted)
Table 1-1 display mac-authentication command output description
|
Field |
Description |
|
MAC address authentication is Enabled |
Whether MAC authentication is enabled |
|
User name format is MAC address in lowercase, like xxxxxxxxxxxx |
Type of user account, which can be MAC-based or shared. l If MAC-based accounts are used, this field displays "User name format is MAC address…" and the format settings for usernames and passwords. In this example, MAC addresses are not hyphenated and in lower case. l If a shared account is used, this field displays "User name format is fixed account." |
|
Fixed username |
Username of the shared account for MAC authentication users. If MAC-based accounts are used, this field displays mac. |
|
Fixed password |
Password of the shared account for MAC authentication users. If MAC-based accounts are used, this field displays not configured. |
|
Offline detect period |
Setting of the offline detect timer |
|
Quiet period |
Setting of the quiet timer |
|
Server response timeout value |
Setting of the server timeout timer |
|
the max allowed user number |
Maximum number of users each slot the AP supports |
|
Current user number amounts to |
Number of online users |
|
Current domain: not configured, use default domain |
Authentication domain that is current used |
|
Silent Mac User info |
Information about quiet MAC addresses |
|
GigabitEthernet1/0/1 is link-up |
Status of the link on port GigabitEthernet 1/0/1. In this example, the link is up. |
|
MAC address authentication is enabled |
Whether MAC authentication is enabled on port Ethernet 1/0/1 |
|
Authenticate success: 0, failed: 0 |
MAC authentication statistics, including the number of successful and unsuccessful authentication attempts |
|
Max number of on-line users |
Maximum number of concurrent online MAC authentication users allowed on the port. If MAC authentication is not enabled on the port, the field displays 0. |
|
Current online user number |
Number of online users on the port |
|
MAC Addr |
MAC address of the online user. |
|
Authenticate state |
User status. Possible values are: l CONNECTING: The user is logging in. l SUCCESS: The user has passed the authentication. l FAILURE: The user failed the authentication. l LOGOFF: The user has logged off. |
|
AuthIndex |
Authenticator Index |
mac-authentication
Syntax
In system view:
mac-authentication [ interface interface-list ]
undo mac-authentication [ interface interface-list ]
In interface view:
mac-authentication
undo mac-authentication
View
System view, Ethernet interface view, WLAN-BSS interface view
Default Level
2: System level
Parameters
interface interface-list: Specifies an Ethernet port list, in the format of { interface-type interface-number [ to interface-type interface-number ] }&<1-10>, where &<1-10> indicates that you can specify up to 10 port ranges. The start port and end port of a port range must be of the same type and the end port number must be greater than the start port number. A port range defined without the to interface-type interface-number portion comprises only one port.
Description
Use the mac-authentication command in system view to enable MAC authentication globally.
Use the mac-authentication interface interface-list in system view to enable MAC authentication on a list of ports, or the mac-authentication command in interface view to enable MAC authentication on a port.
Use the undo mac-authentication command in system view to disable MAC authentication globally.
Use the undo mac-authentication interface interface-list in system view to disable MAC authentication on a list of ports, or the undo mac-authentication in interface view to disable MAC authentication on a port.
By default, MAC authentication is not enabled globally or on any port.
To use MAC authentication on a port, you must enable the function both globally and on the port.
Examples
# Enable MAC authentication globally.
<Sysname> system-view
[Sysname] mac-authentication
Mac-auth is enabled globally.
# Enable MAC authentication for interface WLAN-BSS 0.
<Sysname> system-view
[Sysname] mac-authentication interface WLAN-BSS0
Mac-auth is enabled on port WLAN-BSS0.
Or
<Sysname> system-view
[Sysname] interface WLAN-BSS0
[Sysname- WLAN-BSS0] mac-authentication
Mac-auth is enabled on port WLAN-BSS0.
mac-authentication domain
Syntax
mac-authentication domain domain-name
undo mac-authentication domain
View
System view, interface view
Default Level
2: System level
Parameters
domain-name: Specifies an authentication domain by its name. The domain name takes a case insensitive string of 1 to 24 characters. The domain name cannot contain any forward slash (/), colon (:), asterisk (*), question mark (?), less-than sign (<), greater-than sign (>), or at sign (@).
Description
Use the mac-authentication domain command to specify a global authentication domain in system view or a port specific authentication domain in interface view for MAC authentication users.
Use the undo mac-authentication domain command to restore the default.
By default, the default authentication domain is used for MAC authentication users. For more information about the default authentication domain, see the domain default enable command in AAA in the Security Command Reference.
The global authentication domain is applicable to all MAC authentication enabled ports. A port specific authentication domain is applicable only to the port. You can specify different authentication domains on different ports.
A port chooses an authentication domain for MAC authentication users in this order: port specific domain, global domain, and the default authentication domain.
Related commands: display mac-authentication.
Examples
# Specify the domain1 domain as the global authentication domain for MAC authentication users.
<Sysname> system-view
[Sysname] mac-authentication domain domain1
mac-authentication max-user
Syntax
mac-authentication max-user user-number
undo mac-authentication max-user
View
Ethernet interface view, WLAN-BSS interface view
Default Level
2: System level
Parameters
user-number: Maximum number of concurrent MAC authentication users on the port. The value ranges from 1 to 128.
Parameters
Use the mac-authentication max-user command to set the maximum number of concurrent MAC authentication users on a port.
Use the undo mac-authentication max-user command to restore the default.
By default, the maximum number of concurrent users on a port is 128.
Examples
# Configure interface WLAN-BSS 0 to support up to 32 concurrent MAC authentication users.
<Sysname> system-view
[Sysname] interface WLAN-BSS0
[Sysname-WLAN-BSS0] mac-authentication max-user 32
mac-authentication timer
Syntax
mac-authentication timer { offline-detect offline-detect-value | quiet quiet-value | server-timeout server-timeout-value }
undo mac-authentication timer { offline-detect | quiet | server-timeout }
View
System view
Default Level
2: System level
Parameters
offline-detect offline-detect-value: SSets the offline detect timer, in the range of 60 to 65535 seconds. This timer sets the interval that the device waits for traffic from a user before it regards the user idle. If a user connection has been idle for two consecutive intervals, the device logs the user out and stops accounting for the user.
quiet quiet-value: Sets the quiet timer, in the range of 1 to 3600 seconds. This timer sets the interval that the device must wait before it can perform MAC authentication for a user that has failed MAC authentication. All packets from the MAC address are dropped during the quiet time. This quiet mechanism prevents repeated authentication from affecting system performance.
server-timeout server-timeout-value: Sets the server timeout timer in seconds, in the range of 100 to 300. This timer sets the interval that the access device waits for a response from a RADIUS server before it regards the RADIUS server unavailable. If the timer expires during MAC authentication, the user cannot access the network.
Description
Use the mac-authentication timer command to set the MAC authentication timers.
Use the undo mac-authentication timer command to restore the defaults.
By default, the offline detect timer is 300 seconds, the quiet timer is 60 seconds, and the server timeout timer is 100 seconds.
Related commands: display mac-authentication.
Examples
# Set the server timeout timer to 150 seconds.
<Sysname> system-view
[Sysname] mac-authentication timer server-timeout 150
mac-authentication user-name-format
Syntax
mac-authentication user-name-format { fixed [ account name ] [ password { cipher | simple } password ] | mac-address [ { with-hyphen | without-hyphen } [ lowercase | uppercase ] } }
undo mac-authentication user-name-format
View
System view
Default Level
2: System level
Parameters
fixed: Uses a shared account for all MAC authentication users.
account name: Specifies the username for the shared account. The name takes a case insensitive string of 1 to 55 characters. If no username is specified, the default name mac applies.
password { cipher | simple } password: Specifies the password for the shared user account:
l The cipher option specifies an encrypted password, which is saved in cipher text. You can input 1 to 63 characters in plain text, or 24 or 88 characters in cipher text, for the password. If you input no more than 16 characters in plain text, the string is encrypted into a 24-character password. If you input 16 to 63 characters in plain text, the string is encrypted into an 88-character password. The system treats a 24-character password as a cipher text password, if it can decrypt the password. If not, the system treats the password as a plain text password.
l The simple option specifies a plain text password. You can type a password of 1 to 63 characters only in plain text. The password is saved in plain text.
mac-address: Uses MAC-based user accounts for MAC authentication users. If this option is specified, you must create one user account for each user, and use the MAC address of the user as both the username and password for the account. You can also specify the format of username and password:
l with-hyphen: Hyphenates the MAC address, for example xx-xx-xx-xx-xx-xx.
l without-hyphen: Excludes hyphens from the MAC address, for example, xxxxxxxxxxxx.
l lowercase: Inputs letters in lower case.
l uppercase: Capitalizes letters.
Description
Use the mac-authentication user-name-format command to configure the type of user accounts for MAC authentication users.
Use the undo mac-authentication user-name-format command to restore the default.
By default, each user’s MAC address is used as the username and password for MAC authentication, and letters must be input in lowercase and are not hyphenated.
MAC authentication supports two types of user account:
l One MAC-based user account for each user. A user can pass MAC authentication only when its MAC address matches a MAC-based user account. This approach is suitable for an insecure environment.
l One shared user account for all users. Any user can pass MAC authentication on any MAC authentication enabled port. You can use this approach in a secure environment to limit network resources accessible to MAC authentication users, for example, by assigning an authorized ACL or VLAN for the shared account.
Related commands: display mac-authentication.
Examples
# Configure a shared account for MAC authentication users: set the username as abc and password as xyz, and display the password in plain text.
<Sysname> system-view
[Sysname] mac-authentication user-name-format fixed account abc password simple xyz
# Use MAC-based user accounts for MAC authentication, and each MAC address must be hyphenated and in uppercase.
<Sysname> system-view
[Sysname] mac-authentication user-name-format mac-address with-hyphen uppercase
reset mac-authentication statistics
Syntax
reset mac-authentication statistics [ interface interface-list ]
View
User view
Default Level
2: System level
Parameters
interface interface-list: Specifies a port list, in the format of { interface-type interface-number [ to interface-type interface-number ] }&<1-10>, where &<1-10> indicates that you can specify up to 10 port ranges. The start port and end port of a port range must be of the same type and the end port number must be greater than the start port number. A port range defined without the to interface-type interface-number portion comprises only one port.
Description
Use the reset mac-authentication statistics command to clear MAC authentication statistics.
If no port list is specified, the command clears all global and port-specific MAC authentication statistics. If a port list is specified, the command clears the MAC authentication statistics on the specified ports.
Related commands: display mac-authentication.
Examples
# Clear MAC authentication statistics on interface WLAN-BSS 0.
<Sysname> reset mac-authentication statistics interface WLAN-BSS0
