H3C S6300 Switch Series
Port Security Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Introduction· 1

Prerequisites· 1

General configuration restrictions and guidelines· 1

Example: Configuring autoLearn mode· 1

Network requirements· 1

Requirements analysis· 2

Software version used· 2

Configuration restrictions and guidelines· 2

Configuration procedures· 2

Verifying the configuration· 3

Configuration files· 4

Example: Configuring userLoginWithOUI mode· 4

Network requirements· 4

Requirements analysis· 5

Software version used· 5

Configuration procedures· 5

Configuring the RADIUS server 5

Configuring the device· 7

Verifying the configuration· 8

Configuration files· 10

Example: Configuring macAddressElseUserLoginSecure mode· 10

Network requirements· 10

Requirements analysis· 11

Software version used· 11

Configuration procedures· 11

Configuring the RADIUS server 11

Configuring the device· 13

Verifying the configuration· 14

Configuration files· 16

Related documentation· 17

 

Introduction

This document provides port security configuration examples.

Prerequisites

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of port security.

General configuration restrictions and guidelines

When you configure port security, follow these restrictions and guidelines:

·     Disable global 802.1X and MAC authentications before you enable port security on a port.

·     Port security automatically modifies the following 802.1X or MAC authentication settings for different security modes:

¡     The status of 802.1X and MAC authentication.

¡     The 802.1X access control method.

¡     The 802.1X port authorization state.

·     You cannot disable port security when online users are present.

·     Port security modes are mutually exclusive with link aggregation.

·     The maximum number of users a port supports equals the smaller value from the following values:

¡     The maximum number of secure MAC addresses that port security allows.

¡     The maximum number of concurrent users the authentication mode in use allows.

For example, if 802.1X allows more concurrent users than port security's limit on the number of MAC addresses on the port in userLoginSecureExt mode, port security's limit takes effect.

·     To change the security mode of a port security-enabled port, you must use the undo port-security port-mode command to set the port in noRestrictions mode first.

Example: Configuring autoLearn mode

Network requirements

As shown in Figure 1, configure port security mode autoLearn on Ten-GigabitEthernet 1/0/1 to meet the following requirements:

·     The device accepts a maximum of 64 users to log in through the port without authentication.

·     After the number of users reaches 64, the port denies any new users to access the Internet.

Figure 1 Network diagram

 

Requirements analysis

To meet the network requirements, you must perform the following tasks:

·     Configure the autoLearn mode on the port through which the users access the device. The access port is Ten-GigabitEthernet 1/0/1 in this example.

·     Configure an aging timer for the secure MAC addresses, so the device can update its secure MAC address table.

·     Configure Ten-GigabitEthernet 1/0/1 to shut down temporarily for 30 seconds when it receives illegal frames. The device can deny any new users to access the Internet after the number of online users reaches 64.

Software version used

This configuration example was created and verified on S6300-CMW710-R2310.

Configuration restrictions and guidelines

Before you enable the autoLearn mode, set the maximum number of secure MAC addresses that port security allows on the port (by using the port-security max-mac-count command). You cannot change the setting when the port is operating in autoLearn mode.

Configuration procedures

# Enable port security.

<Device> system-view

[Device] port-security enable

# Set the secure MAC aging timer to 30 minutes.

[Device] port-security timer autolearn aging 30

# Set port security's limit on the number of secure MAC addresses to 64 on Ten-GigabitEthernet 1/0/1.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] port-security max-mac-count 64

# Set the port security mode to autoLearn.

[Device-Ten-GigabitEthernet1/0/1] port-security port-mode autolearn

# Specify the intrusion protection action as disableport-temporarily.

[Device-Ten-GigabitEthernet1/0/1] port-security intrusion-mode disableport-temporarily

[Device-Ten-GigabitEthernet1/0/1] quit

# Configure the port to be silent for 30 seconds after the intrusion protection feature is triggered.

[Device] port-security timer disableport 30

Verifying the configuration

# Verify that port security is correctly configured.

[Device] display port-security interface ten-gigabitethernet 1/0/1

 Port security is enabled globally

 AutoLearn aging time is 30 minutes

 Disableport Timeout: 30s

 MAC-move is denied

 OUI value:

 

Ten-GigabitEthernet1/0/1 is link-up

   Port mode: autoLearn

   NeedToKnow mode: Disabled

   Intrusion protection mode: DisablePortTemporarily

   Max number of secure MAC addresses: 64

   Current number of secure MAC addresses: 5

   Authorization is permitted

The port allows for MAC address learning, and you can view the number of learned MAC addresses in the Current number of secure MAC addresses field.

# Display information about the learned MAC addresses.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] display this

 port-security intrusion-mode disableport-temporarily

 port-security max-mac-count 64

 port-security port-mode autolearn

 port-security mac-address security sticky 00e0-fc00-5920 vlan 1

 port-security mac-address security sticky 00e0-fc00-592a vlan 1

 port-security mac-address security sticky 00e0-fc00-592b vlan 1

 port-security mac-address security sticky 00e0-fc00-592c vlan 1

 port-security mac-address security sticky 00e0-fc00-592d vlan 1

[Device-Ten-GigabitEthernet1/0/1] quit

# Verify that the port security mode changes to secure after the number of MAC addresses learned by the port reaches 64.

[Device] display port-security interface ten-gigabitethernet 1/0/1

# Verify that the port is disabled after it receives a frame with an unknown MAC address.

[Device] display interface ten-gigabitethernet 1/0/1

# Verify that the interface is re-enabled after 30 seconds.

[Device] display interface ten-gigabitethernet 1/0/1

# Delete several secure MAC addresses.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] undo port-security mac-address security sticky 00e0-fc00-5920 vlan 1

[Device-Ten-GigabitEthernet1/0/1] undo port-security mac-address security sticky 00e0-fc00-592a vlan 1

…

# Verify that the port security mode changes to autoLearn and the port can learn MAC addresses again. (Details not shown.)

Configuration files

#

 port-security enable

 port-security timer disableport 30

 port-security timer autolearn aging 30

#

interface Ten-GigabitEthernet1/0/1

 port-security intrusion-mode disableport-temporarily

 port-security max-mac-count 64

 port-security port-mode autolearn

#

Example: Configuring userLoginWithOUI mode

Network requirements

As shown in Figure 2:

·     Users use the 802.1X client on the host to initiate 802.1X authentication.

·     The device uses the RADIUS server to perform authentication, authorization, and accounting for all users in ISP domain sun.

·     IMC is the RADIUS server.

·     The device and the server use the shared key expert for secure RADIUS communication.

Configure port security mode userLoginWithOUI on the device to meet the following requirements:

·     Permit only one 802.1X user to pass authentication to access the Internet.

·     Permit the printer to access the Internet.

·     Discard all illegal frames without disabling the port security-enabled port.

Figure 2 Network diagram

 

Requirements analysis

To meet the network requirements, you must perform the following tasks:

·     Configure the userLoginWithOUI mode on the port through which the users access the device. The access port is Ten-GigabitEthernet 1/0/1 in this example.

·     Add the printer's OUI to the port security module of the device, so the device can permit the printer to access the Internet in userLoginWithOUI mode. To match the OUIs of different printer vendors, add multiple OUIs to the device.

·     Configure the blockmac intrusion protection on Ten-GigabitEthernet 1/0/1, so the device adds the source MAC addresses of illegal frames to the blocked MAC address list. The device discards all frames sourced from the blocked MAC addresses.

Software version used

This configuration example was created and verified on S6300-CMW710-R2310.

Configuration procedures

Configuring the RADIUS server

In this example, the RADIUS server runs IMC PLAT 7.0 (E0201) and IMC UAM 7.0 (E0201).

1.     Add the device to IMC as an access device:

a.     Click the User tab.

b.     From the navigation tree, select User Access Policy > Access Device Management > Access Device.

c.     Click Add.

The Add Access Device page appears.

d.     In the Access Configuration area, configure the following parameters:

-     Enter 1812 in the Authentication Port field, and enter 1813 in the Accounting Port field.

-     Select LAN Access Service from the Service Type list.

-     Select H3C(General) from the Access Device Type list.

-     Enter expert in the Shared Key and Confirm Shared Key field.

-     Use the default values for other parameters.

e.     In the Device List area, click Select or Add Manually to add the device at 192.168.0.34 as an access device.

The IP address of the access device specified here must be the same as the source IP address of the RADIUS packets sent from the device. The source IP address is chosen in the following order on the device:

-     IP address specified by the nas-ip command.

-     IP address specified by the radius nas-ip command.

-     IP address of the outbound interface (the default).

f.     Click OK.

 

2.     Add an access policy:

a.     Click the User tab.

b.     From the navigation tree, select User Access Policy > Access Policy.

c.     Click Add.

d.     On the page that appears, configure the following parameters, as shown in Figure 3:

-     Enter 802.1X-auth in the Access Policy Name field.

-     Use the default values for other parameters.

Figure 3 Adding an access policy

 

e.     Click OK.

3.     Add an access service:

a.     Click the User tab.

b.     From the navigation tree, select User Access Policy > Access Service.

c.     Click Add.

d.     On the page that appears, configure the following parameters, as shown in Figure 4:

-     Enter 802.1X-auth in the Service Name field.

-     Select 802.1X-auth from the Default Access Policy list.

Figure 4 Adding an access service

 

e.     Click OK.

4.     Add an access user:

a.     Click the User tab.

b.     From the navigation tree, select Access User Management > All Access Users.

The access user list appears.

c.     Click Add.

d.     On the Add Access User page, configure the following parameters, as shown in Figure 5:

-     Click Select or Add User to associate the user with IMC Platform user hello.

-     Enter 802.1X in the Account Name field.

-     Enter 802.1X in the Password and Confirm Password fields.

-     Configure other parameters in the Access Information area as needed.

-     Select 802.1X-auth from the Access Service list.

Figure 5 Adding an access user account

 

e.     Click OK.

Configuring the device

The following steps have AAA RADIUS commands. For more information about the AAA RADIUS commands, see AAA commands in the security command reference for the device.

1.     Assign an IP address to each interface, as shown in Figure 2. Make sure the host, printer, device, and RADIUS server can reach each other. (Details not shown.)

2.     Configure the RADIUS scheme:

# Create RADIUS scheme radsun.

<Device> system-view

[Device] radius scheme radsun

New RADIUS scheme.

# Specify the primary RADIUS authentication server at 192.168.0.38.

[Device-radius-radsun] primary authentication 192.168.0.38

# Specify the primary RADIUS accounting server at 192.168.0.38.

[Device-radius-radsun] primary accounting 192.168.0.38

# Set the authentication shared key to expert in plain text for secure communication between the device and the RADIUS server.

[Device-radius-radsun] key authentication simple expert

# Set the accounting shared key to expert in plain text for secure communication between the device and the RADIUS server.

[Device-radius-radsun] key accounting simple expert

# Set the response timeout time of the RADIUS server to 5 seconds.

[Device-radius-radsun] timer response-timeout 5

# Set the maximum number of RADIUS packet retransmission attempts to 5.

[Device-radius-radsun] retry 5

# Set the real-time accounting interval to 15 minutes.

[Device-radius-radsun] timer realtime-accounting 15

# Exclude domain names from the usernames sent to the RADIUS server.

[Device-radius-radsun] user-name-format without-domain

[Device-radius-radsun] quit

# Create ISP domain sun and enter ISP domain view.

[Device] domain sun

# Configure ISP domain sun to use RADIUS scheme radsun for authentication, authorization, and accounting of all LAN users.

[Device-isp-sun] authentication lan-access radius-scheme radsun

[Device-isp-sun] authorization lan-access radius-scheme radsun

[Device-isp-sun] accounting lan-access radius-scheme radsun

[Device-isp-sun] quit

# Configure domain sun as the default domain.

[Device] domain default enable sun

3.     Set the 802.1X authentication method to CHAP. By default, the authentication method for 802.1X is CHAP.

[Device] dot1x authentication-method chap

4.     Configure port security:

# Add five OUI values.

[Device] port-security oui index 1 mac-address 1234-0100-1111

[Device] port-security oui index 2 mac-address 1234-0200-1111

[Device] port-security oui index 3 mac-address 1234-0300-1111

[Device] port-security oui index 4 mac-address 1234-0400-1111

[Device] port-security oui index 5 mac-address 1234-0500-1111

# Set the port security mode to userLoginWithOUI.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] port-security port-mode userlogin-withoui

# Configure port Ten-GigabitEthernet 1/0/1 to perform the blockmac intrusion protection action.

[Device-Ten-GigabitEthernet1/0/1] port-security intrusion-mode blockmac

[Device-Ten-GigabitEthernet1/0/1] quit

# Enable port security.

[Device] port-security enable

Verifying the configuration

# Display RADIUS scheme radsun.

[Device] display radius scheme radsun

RADIUS Scheme Name  : radsun

  Index : 1

  Primary Auth Server:

    IP  : 192.168.0.38                              Port: 1812   State: Active

    VPN : Not configured

  Primary Acct Server:

    IP  : 192.168.0.38                              Port: 1813   State: Active

    VPN : Not configured

 

  Accounting-On function                         : Disabled

    retransmission times                         : 50

    retransmission interval(seconds)             : 3

  Timeout Interval(seconds)                      : 5

  Retransmission Times                           : 5

  Retransmission Times for Accounting Update     : 5

  Server Quiet Period(minutes)                   : 5

  Realtime Accounting Interval(minutes)          : 15

  NAS IP Address                                 : Not configured

  VPN                                            : Not configured

  User Name Format                               : without-domain

  Attribute 15 check-mode                        : Strict

# Display port security configuration on Ten-GigabitEthernet 1/0/1.

[Device] display port-security interface ten-gigabitethernet 1/0/1

 Port security is enabled globally

 AutoLearn aging time is 0 minutes

 Disableport Timeout: 20s

 MAC-move is denied

 OUI value:

   Index is 1,    OUI value is 123401

   Index is 2,    OUI value is 123402

   Index is 3,    OUI value is 123403

   Index is 4,    OUI value is 123404

   Index is 5,    OUI value is 123405

 

 Ten-GigabitEthernet1/0/1 is link-up

   Port mode : userLoginWithOUI

   NeedToKnow mode: Disabled

   Intrusion protection mode: BlockMacAddress

   Max number of secure MAC addresses: Not configured

   Current number of secure MAC addresses: 0

   Authorization is permitted

After an 802.1X user comes online, the number of secure MAC addresses saved by the port is 1.

# Display 802.1X information.

[Device] display dot1x interface ten-gigabitethernet 1/0/1

# Verify that Ten-GigabitEthernet 1/0/1 allows a user whose MAC address has an OUI from the specified OUIs to pass authentication.

[Device] display mac-address interface ten-gigabitethernet 1/0/1

MAC Address     VLAN ID   State           Port                  Aging

1234-0300-0011  1          Learned        XGE1/0/1              Y

Configuration files

#

 port-security enable

 port-security oui index 1 mac-address 1234-0100-0000

 port-security oui index 2 mac-address 1234-0200-0000

 port-security oui index 3 mac-address 1234-0300-0000

 port-security oui index 4 mac-address 1234-0400-0000

 port-security oui index 5 mac-address 1234-0500-0000

#

interface Ten-GigabitEthernet1/0/1

port-security port-mode userlogin-withoui

port-security intrusion-mode blockmac

#

radius scheme radsun

 primary authentication 192.168.0.38

 primary accounting 192.168.0.38

 key authentication cipher $c$3$s9TAYm34R8sS5k/Cylg2sDm69ZRupMvGJg==

 key accounting cipher $c$3$UaUPGk8AfZAQLHFlbKNcEoM2HXGiuWowBQ==

 retry 5

 timer response-timeout 5

 timer realtime-accounting 15

 user-name-format without-domain

#

radius scheme system

 user-name-format without-domain

#

domain sun

 authentication lan-access radius-scheme radsun

 authorization lan-access radius-scheme radsun

 accounting lan-access radius-scheme radsun

#

domain default enable sun

#

Example: Configuring macAddressElseUserLoginSecure mode

Network requirements

As shown in Figure 6, the device uses the RADIUS server to perform authentication, authorization, and accounting for all users in domain sun.

Configure port security mode macAddressElseUserLoginSecure on the device to meet the following requirements:

·     Allow only one 802.1X user to pass authentication, and allow multiple MAC authentication users to pass authentication.

·     Perform MAC authentication first for an 802.1X user, and then 802.1X authentication if the user fails MAC authentication.

·     Use shared user account with username aaa and password 123456 for MAC authentication users.

·     Allow a maximum of 64 authenticated users.

·     Prevent frames from being sent to unknown MAC addresses.

Figure 6 Network diagram

 

Requirements analysis

To meet the network requirements, you must perform the following tasks:

·     Configure the macAddressElseUserLoginSecure mode on the port through which the users access the device. The access port is Ten-GigabitEthernet 1/0/1 in this example.

·     Set the NTK mode to ntkonly, so the device will prevent frames from being sent to unknown MAC addresses. In this mode, the device permits only unicast frames that are destined for the authenticated MAC addresses.

Software version used

This configuration example was created and verified on S6300-CMW710-R2310.

Configuration procedures

Configuring the RADIUS server

In this example, the RADIUS server runs IMC PLAT 7.0 (E0201) and IMC UAM 7.0 (E0201).

1.     Add the device to IMC as an access device in the same way the device is added to IMC in "Example: Configuring userLoginWithOUI mode."

2.     Add an access policy, an access service, and an access user for 802.1X authentication in the same way they are added in "Example: Configuring userLoginWithOUI mode."

3.     Add an access policy for MAC authentication:

a.     Click the User tab.

b.     From the navigation tree, select User Access Policy > Access Policy.

c.     Click Add.

d.     On the page that appears, configure the following parameters, as shown in Figure 7:

-     Enter MAC-auth in the Access Policy Name field.

-     Use the default values for other parameters.

Figure 7 Adding an access policy

 

e.     Click OK.

4.     Add an access service for MAC authentication:

a.     Click the User tab.

b.     From the navigation tree, select User Access Policy > Access Service.

c.     Click Add.

d.     On the page that appears, configure the following parameters, as shown in Figure 8:

-     Enter MAC-auth in the Service Name field.

-     Select MAC-auth from the Default Access Policy list.

Figure 8 Adding an access service

 

e.     Click OK.

5.     Add an access user for MAC authentication:

a.     Click the User tab.

b.     From the navigation tree, select Access User Management > All Access Users.

The access user list appears.

c.     Click Add.

d.     On the Add Access User page, configure the following parameters, as shown in Figure 9:

-     Click Select or Add User to associate the user with IMC Platform user hello2.

-     Enter aaa in the Account Name field.

-     Enter 123456 in the Password and Confirm Password fields.

-     Configure other parameters in the Access Information area as needed.

-     Select MAC-auth from the Access Service list.

Figure 9 Adding an access user account

 

e.     Click OK.

Configuring the device

1.     Assign an IP address to each interface, as shown in Figure 6. Make sure the hosts, device, and RADIUS server can reach each other. (Details not shown.)

2.     Configure the RADIUS scheme:

# Create RADIUS scheme radsun.

<Device> system-view

[Device] radius scheme radsun

New RADIUS scheme.

# Specify the primary RADIUS authentication server at 192.168.0.38.

[Device-radius-radsun] primary authentication 192.168.0.38

# Specify the primary RADIUS accounting server at 192.168.0.38.

[Device-radius-radsun] primary accounting 192.168.0.38

# Set the authentication shared key to expert in plain text for secure communication between the device and the RADIUS server.

[Device-radius-radsun] key authentication simple expert

# Set the accounting shared key to expert in plain text for secure communication between the device and the RADIUS server.

[Device-radius-radsun] key accounting simple expert

# Set the response timeout time of the RADIUS server to 5 seconds.

[Device-radius-radsun] timer response-timeout 5

# Set the maximum number of RADIUS packet retransmission attempts to 5.

[Device-radius-radsun] retry 5

# Set the real-time accounting interval to 15 minutes.

[Device-radius-radsun] timer realtime-accounting 15

# Exclude domain names from the usernames sent to the RADIUS server.

[Device-radius-radsun] user-name-format without-domain

[Device-radius-radsun] quit

# Create ISP domain sun and enter ISP domain view.

[Device] domain sun

# Configure ISP domain sun to use RADIUS scheme radsun for authentication, authorization, and accounting of all LAN users.

[Device-isp-sun] authentication lan-access radius-scheme radsun

[Device-isp-sun] authorization lan-access radius-scheme radsun

[Device-isp-sun] accounting lan-access radius-scheme radsun

[Device-isp-sun] quit

# Specify ISP domain sun as the default domain.

[Device] domain default enable sun

3.     Configure MAC authentication:

# Configure a shared account for MAC authentication users, and set the username to aaa and password to plaintext string of 123456.

[Device] mac-authentication user-name-format fixed account aaa password simple 123456

# Specify domain sun as the global MAC authentication domain.

[Device] mac-authentication domain sun

4.     Set the 802.1X authentication method to CHAP. By default, the authentication method for 802.1X is CHAP.

[Device] dot1x authentication-method chap

5.     Configure port security:

# Set port security's limit on the number of secure MAC addresses to 64 on Ten-GigabitEthernet 1/0/1.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] port-security max-mac-count 64

# Set the port security mode to macAddressElseUserLoginSecure.

[Device-Ten-GigabitEthernet1/0/1] port-security port-mode mac-else-userlogin-secure

# Set the NTK mode of the port to ntkonly.

[Device-Ten-GigabitEthernet1/0/1] port-security ntk-mode ntkonly

[Device-Ten-GigabitEthernet1/0/1] quit

# Enable port security.

[Device] port-security enable

Verifying the configuration

# Verify that port security is correctly configured.

[Device] display port-security interface ten-gigabitethernet 1/0/1

 Port security is enabled globally

 AutoLearn aging time is 0 minutes

 Disableport Timeout: 20s

 MAC-move is denied

 OUI value:

 

 Ten-GigabitEthernet1/0/1 is link-up

    Port mode: macAddressElseUserLoginSecure

    NeedToKnow mode: NeedToKnowOnly

    Intrusion protection mode: NoAction

    Max number of secure MAC addresses: 64

    Current number of secure MAC addresses: 0

    Authorization is permitted

# Verify that port GigabitEthernet 1/0/1 allows multiple MAC authentication users to be authenticated.

[Device] display mac-authentication interface ten-gigabitethernet 1/0/1

 MAC authentication is enabled

 User name format is fixed account

 Fixed username: aaa

 Fixed password: ******

         Offline detect period is 300s

         Quiet period is 60s

         Server response timeout value is 100s

         Max number of users is 2048 per slot

         Current number of online users is 3

         Current authentication domain is sun

 

 Silent MAC user info:

          MAC Addr         VLAN ID  From Port                    Port Index

 

 Ten-GigabitEthernet1/0/1 is link-up

   MAC authentication is enabled

   Max number of online users is 2048

   Current number of online users is 3

   Current authentication domain: Not configured

   MAC auth-delay is disabled

   Authentication attempts: successful 3, failed 7

    MAC Addr         Auth state

    1234-0300-0011   authenticated

    1234-0300-0012   authenticated

    1234-0300-0013   authenticated

# Verify that Ten-GigabitEthernet 1/0/1 allows only one 802.1X user to be authenticated.

[Device] display dot1x interface ten-gigabitethernet 1/0/1

 802.1X protocol is enabled globally

 CHAP authentication is enabled

 Configuration: Transmit Period   30 s,  Handshake Period       15 s

                Quiet Period      60 s,  Quiet Timer is disabled

                Supp Timeout      30 s,  Server Timeout         100 s

                Reauth Period     3600 s

                Max attempts for sending an authentication request        2

 Max number of 802.1X users is 2048 per slot

 Current number of online 802.1X users is 1

 

 Ten-GigabitEthernet1/0/1  is link-up

   802.1X protocol is enabled

   Handshake is enabled

   802.1X unicast-trigger is disabled

   Periodic reauthentication is disabled

   The port is an authenticator

   Authentication mode is Auto

   Port access control type is MAC-based

   802.1X multicast-trigger is enabled

   Mandatory authentication domain: Not configured

   Max online users is 2048

 

   EAPOL Packets: Tx 16331, Rx 102

   Sent EAP Request/Identity Packets : 16316

        EAP Request/Challenge Packets: 6

        EAP Success Packets: 4, Fail Packets: 5

   Received EAPOL Start Packets : 6

            EAPOL LogOff Packets: 2

            EAP Response/Identity Packets : 80

            EAP Response/Challenge Packets: 6

            Error Packets: 0

1. Authenticated user MAC address: 0002-0000-0011

   Controlled Users: 1

# Verify that frames with an unknown destination MAC address, multicast address, or broadcast address are discarded. (Details not shown.)

Configuration files

#

 mac-authentication domain sun

 mac-authentication user-name-format fixed account aaa password cipher $c$3$HAlQ

nyXOwZXTgiOBPd7+kSPClKm7JbZ1Rw==

#

 port-security enable

#

interface Ten-GigabitEthernet1/0/1

 port-security ntk-mode ntkonly

 port-security max-mac-count 64

 port-security port-mode mac-else-userlogin-secure

#

radius scheme radsun

 primary authentication 192.168.0.38

 primary accounting 192.168.0.38

 key authentication cipher $c$3$s9TAYm34R8sS5k/Cylg2sDm69ZRupMvGJg==

 key accounting cipher $c$3$UaUPGk8AfZAQLHFlbKNcEoM2HXGiuWowBQ==

 retry 5

 timer response-timeout 5

 timer realtime-accounting 15

 user-name-format without-domain

#

radius scheme system

 user-name-format without-domain

#

domain sun

 authentication lan-access radius-scheme radsun

 authorization lan-access radius-scheme radsun

 accounting lan-access radius-scheme radsun

#

domain default enable sun

#

Related documentation

·     H3C S6300 Switch Series Security Configuration Guide-Release 23xx

·     H3C S6300 Switch Series Security Command Reference-Release 23xx