Document version: 6W100-20201125

Contents

Introduction· 1

Prerequisites· 1

Example: Configuring local MAC authentication for clients (IPv6) 1

Network configuration· 1

Procedures· 2

Configuring the fat AP· 2

Verifying the configuration· 3

Related documentation· 3

Introduction

The following information provides an example to configure local MAC authentication for control of access to an IPv6 wireless network.

Prerequisites

The following information applies to Comware 7-based access points. Procedures and information in the examples might be slightly different depending on the software or hardware version of the access points.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of MAC authentication, WLAN authentication, and WLAN access.

Example: Configuring local MAC authentication for clients (IPv6)

Network configuration

As shown in Figure 1:

·     The clients access the WLAN through the fat AP. The clients are in VLAN 100.

·     The fat AP obtains an IPv6 address for its uplink interface from the DHCPv6 server on the network.

·     The fat AP acts as a DHCPv6 server to assign IPv6 addresses to the clients.

Configure the fat AP to perform local MAC authentication to control the network access of clients. The MAC address of each client is used as both the username and password for MAC authentication. The MAC addresses are in hexadecimal notation without hyphens, and letters are in lower case.

Figure 1 Network diagram

Procedures

Configuring the fat AP

1.     Configure AP interfaces:

# Create VLAN 100 and VLAN-interface 100, and assign an IPv6 address to the VLAN interface.

<FAT AP> system-view

[FAT AP] vlan 100

[FAT AP-vlan100] quit

[FAT AP] interface vlan-interface 100

[FAT AP-Vlan-interface100] ipv6 address 3001::1 96

[FAT AP-Vlan-interface100] quit

# Configure uplink interface VLAN-interface 10 to obtain an IPv6 address through DHCP.

[FAT AP] vlan 10

[FAT AP-vlan10] quit

[FAT AP] interface vlan-interface 10

[FAT AP-Vlan-interface10] ipv6 address dhcp-alloc

[FAT AP-Vlan-interface10] quit

2.     Configure the DHCPv6 service:

# Create a DHCPv6 address pool named 100 and add subnet 3001::2/96 to the DHCPv6 address pool for assignment of IPv6 addresses to the clients.

[FAT AP] ipv6 dhcp pool 100 

[FAT AP-dhcp-pool-100] network 3001::2/96 

[FAT AP-dhcp-pool-100] quit

# Enable the DHCPv6 server on VLAN interface 100 and apply DHCPv6 address pool 100 to the VLAN interface.

[FAT AP] interface vlan-interface 100

[FAT AP-Vlan-interface100] ipv6 dhcp select server

[FAT AP-Vlan-interface100] ipv6 dhcp server apply pool 100

[FAT AP-Vlan-interface100] ipv6 nd autoconfig managed-address-flag              

[FAT AP-Vlan-interface100] ipv6 nd autoconfig other-flag                          

[FAT AP-Vlan-interface100] undo ipv6 nd ra halt 

[FAT AP-Vlan-interface100] quit

3.     Create ISP domain local-mac and configure local authentication for LAN users in the ISP domain.

[FAT AP] domain local-mac

[FAT AP-isp-local-mac] authentication lan-access local

[FAT AP-isp-local-mac] quit

4.     Create a network access user, set the username and password to 38295a409589 (the MAC address of the client), and specify the LAN access service for the user.

[FAT AP] local-user 38295a409589 class network

[FAT AP-luser-network-38295a409589] password simple 38295a409589

[FAT AP-luser-network-38295a409589] service-type lan-access

[FAT AP-luser-network-38295a409589] quit

5.     Use the MAC address of each user as both the username and password for MAC authentication. The MAC addresses are in hexadecimal notation without hyphens, and letters are in lower case. (The configuration is the default settings. This step is optional.)

[FAT AP] mac-authentication user-name-format mac-address without-hyphen lowercase

6.     Configure a wireless service:

# Create service template 1 and enter its view.

[FAT AP] wlan service-template 1

# Set the SSID of service template 1 to service.

[FAT AP-wlan-st-service] ssid service

# Set the VLAN of the service template to VLAN 100.

[FAT AP-wlan-st-service] vlan 100

[FAT AP-wlan-st-service] client-security authentication-mode mac

# Specify ISP domain local-mac as the MAC authentication domain.

[FAT AP-wlan-st-service] mac-authentication domain local-mac

# Enable the service template.

[FAT AP-wlan-st-service] service-template enable

# Enable snooping ND packets and enable snooping DHCPv6 packets.

[FAT AP-wlan-st-service] client ipv6-snooping nd-learning enable

[FAT AP-wlan-st-service] client ipv6-snooping dhcpv6-learning enable

[FAT AP-wlan-st-service] quit

# Enter the view of WLAN-Radio 1/0/1.

[FAT AP] interface wlan-radio 1/0/1

# Bind service template 1 to interface WLAN-Radio 1/0/1.

[FAT AP-WLAN-Radio1/0/1] service-template 1

[FAT AP-WLAN-Radio1/0/1] quit

Verifying the configuration

# Access the WLAN from the client. Verify that the client can access the WLAN after passing MAC authentication. (Details not shown.)

# Verify that the client has come online in VLAN 100 on the fat AP.

[FAT AP] display wlan client ipv6

MAC address    AP name              IPv6 address                            VLAN

3829-5a40-9589 fatap                3001::5                                 100

Related documentation

·     Network Connectivity Configuration Guide in H3C Access Points Configuration Guides

·     Network Connectivity Command Reference in H3C Access Points Command References

·     User Access and Authentication Configuration Guide in H3C Access Points Configuration Guides

·     User Access and Authentication Command Reference in H3C Access Points Command References

·     WLAN Access Configuration Guide in H3C Access Points Configuration Guides

·     WLAN Access Command Reference in H3C Access Points Command References