09-Security Configuration Guide

HomeSupportSwitchesS6800 SeriesConfigure & DeployConfiguration GuidesH3C S6800 Switch Series Configuration Guide-Release 26xx-6W10709-Security Configuration Guide
03-MAC authentication configuration
Title Size Download
03-MAC authentication configuration 340.53 KB

Contents

Configuring MAC authentication· 1

Overview· 1

User account policies· 1

Authentication methods· 1

VLAN assignment 2

Authorization VLAN· 2

Guest VLAN· 4

Critical VLAN· 4

Critical voice VLAN· 5

VSI manipulation· 6

MAC authentication support for VXLANs· 6

Authorization VSI 6

Guest VSI 7

Critical VSI 7

ACL assignment 8

User profile assignment 8

Redirect URL assignment 8

Blackhole MAC attribute assignment 9

Configuration prerequisites· 9

Configuration restrictions and guidelines· 9

MAC authentication-enabled port configuration restrictions· 9

MAC authentication VLAN and VSI assignment restrictions· 10

Configuration task list 10

Enabling MAC authentication· 11

Specifying a MAC authentication domain· 11

Configuring the user account format 12

Configuring MAC authentication timers· 12

Setting the maximum number of concurrent MAC authentication users on a port 13

Enabling MAC authentication multi-VLAN mode on a port 13

Configuring MAC authentication delay· 14

Enabling parallel processing of MAC authentication and 802.1X authentication· 14

Configuration restrictions and guidelines· 14

Configuration procedure· 15

Configuring a MAC authentication guest VLAN· 15

Configuring a MAC authentication critical VLAN· 16

Enabling the MAC authentication critical voice VLAN· 17

Configuration prerequisites· 17

Configuration procedure· 17

Configuring a MAC authentication guest VSI 17

Configuration restrictions and guidelines· 17

Configuration prerequisites· 17

Configuration procedure· 18

Configuring a MAC authentication critical VSI 18

Configuration restrictions and guidelines· 18

Configuration prerequisites· 18

Configuration procedure· 18

Configuring periodic MAC reauthentication· 19

Overview· 19

Configuration restrictions and guidelines· 19

Configuration procedure· 20

Including user IP addresses in MAC authentication requests· 20

Overview· 20

Configuration restrictions and guidelines· 21

Configuration procedure· 21

Enabling MAC authentication offline detection· 21

Enabling MAC authentication user logging· 22

Overview· 22

Configuration restrictions and guidelines· 22

Configuration procedure· 22

Displaying and maintaining MAC authentication· 22

MAC authentication configuration examples· 23

Local MAC authentication configuration example· 23

RADIUS-based MAC authentication configuration example· 25

ACL assignment configuration example· 27

MAC authentication authorization VSI assignment configuration example· 30

 


Configuring MAC authentication

Overview

MAC authentication controls network access by authenticating source MAC addresses on a port. The feature does not require client software, and users do not have to enter a username and password for network access. The device initiates a MAC authentication process when it detects an unknown source MAC address on a MAC authentication-enabled port. If the MAC address passes authentication, the user can access authorized network resources. If the authentication fails, the device marks the MAC address as a silent MAC address, drops the packet, and starts a quiet timer. The device drops all subsequent packets from the MAC address within the quiet time. The quiet mechanism avoids repeated authentication during a short time.

 

 

NOTE:

If the MAC address that has failed authentication is a static MAC address or a MAC address that has passed any security authentication, the device does not mark the MAC address as a silent address.

 

User account policies

MAC authentication supports the following user account policies:

·     One MAC-based user account for each user. The access device uses the source MAC addresses in packets as the usernames and passwords of users for MAC authentication. This policy is suitable for an insecure environment.

·     One shared user account for all users. You specify one username and password, which are not necessarily a MAC address, for all MAC authentication users on the access device. This policy is suitable for a secure environment.

Authentication methods

You can perform MAC authentication on the access device (local authentication) or through a RADIUS server.

Local authentication:

·     MAC-based accounts—The access device uses the source MAC address of the packet as the username and password to search the local account database for a match.

·     A shared account—The access device uses the shared account username and password to search the local account database for a match.

RADIUS authentication:

·     MAC-based accounts—The access device sends the source MAC address of the packet as the username and password to the RADIUS server for authentication.

·     A shared account—The access device sends the shared account username and password to the RADIUS server for authentication.

For more information about configuring local authentication and RADIUS authentication, see "Configuring AAA."

VLAN assignment

Authorization VLAN

The authorization VLAN controls the access of a MAC authentication user to authorized network resources. The device supports authorization VLANs assigned locally or by a remote server.

 

IMPORTANT

IMPORTANT:

Only remote servers can assign tagged authorization VLANs.

 

Remote VLAN authorization

In remote VLAN authorization, you must configure the authorization VLAN for a user on the remote server. After the user authenticates to the server, the server assigns authorization VLAN information to the device. Then, the device assigns the user access port to the authorization VLAN as a tagged or untagged member.

The device supports assignment of the following authorization VLAN information by the remote server:

·     VLAN ID.

·     VLAN name, which must be the same as the VLAN description on the access device.

·     Astring of VLAN IDs and VLAN names.

In the string, some VLANs are represented by their IDs, and some VLANs are represented by their names.

·     VLAN group name.

For more information about VLAN groups, see Layer 2—LAN Switching Configuration Guide.

·     VLAN ID with a suffix of t or u.

The t and u suffixes require the device to assign the access port to the VLAN as a tagged or untagged member, respectively. For example, 2u indicates assigning the port to VLAN 2 as an untagged member.

If a VLAN name or VLAN group name is assigned, the device converts the information into a VLAN ID before VLAN assignment.

 

IMPORTANT

IMPORTANT:

For a VLAN represented by its VLAN name to be assigned successfully, you must make sure the VLAN has been created on the device.

To assign VLAN IDs with suffixes, make sure the access port is a hybrid or trunk port.

 

IMPORTANT

IMPORTANT:

To ensure a successful assignment, the authorization VLANs assigned by the remote server cannot be any of the following types:

·     Dynamically learned VLANs.

·     Reserved VLANs.

·     Super VLANs.

·     Private VLANs.

 

If the server assigns a group of VLANs, the access device selects a VLAN as described in Table 1.

Table 1 Authorization VLAN selection from a group of VLANs

VLAN information

Authorization VLAN selection

VLANs by IDs

VLANs by names

VLAN group name

The device selects an authorization VLAN from the VLAN group for a user according to the following rules:

·     On a hybrid port with MAC-based VLAN enabled:

¡     If the port does not have online users, the device selects the VLAN with the lowest ID.

¡     If the port has online users, the device selects the VLAN that has the fewest online users. If two VLANs have the same number of online 802.1X users, the device selects the VLAN with the lower ID.

·     On an access, trunk, or MAC-based VLAN disabled hybrid port:

¡     If the port does not have online users, the device selects the VLAN with the lowest ID.

¡     If the port has online users, the device examines the VLAN group for the VLAN of the online users. If the VLAN is found, the VLAN is assigned to the user as the authorization VLAN. If the VLAN is not found, VLAN authorization fails.

VLAN IDs with suffixes

1.     The device selects the leftmost VLAN ID without a suffix, or the leftmost VLAN ID suffixed by u as an untagged VLAN, whichever is more leftmost.

2.     The device assigns the untagged VLAN to the port as the PVID, and it assigns the remaining as tagged VLANs. If no untagged VLAN is assigned, the PVID of the port does not change. The port permits traffic from these tagged and untagged VLANs to pass through.

For example, the authentication server sends the string 1u 2t 3 to the access device for a user. The device assigns VLAN 1 as an untagged VLAN and all remaining VLANs (including VLAN 3) as tagged VLANs. VLAN 1 becomes the PVID.

 

Local VLAN authorization

To perform local VLAN authorization for a user, specify the VLAN ID in the authorization attribute list of the local user account for that user. For each local user, you can specify only one authorization VLAN ID. The port through which the user accesses the device is assigned to the VLAN as an untagged member.

 

IMPORTANT

IMPORTANT:

Local VLAN authorization does not support assignment of tagged VLANs.

 

For more information about local user configuration, see "Configuring AAA."

Authorization VLAN manipulation for a MAC authentication-enabled port

Table 2 describes the way the network access device handles authorization VLANs (except for the VLANs specified with suffixes) for MAC authenticated users on a port.

Table 2 VLAN manipulation

Port type

VLAN manipulation

·     Access port

·     Trunk port

·     Hybrid port with MAC-based VLAN disabled

·     The device assigns the port to the first authenticated user's authorization VLAN and sets the VLAN as the PVID if that authorization VLAN has the untagged attribute.

·     If the authorization VLAN has the tagged attribute, the device assigns the port to the authorization VLAN without changing its PVID.

Hybrid port with MAC-based VLAN enabled

The device maps the MAC address of each user to its own authorization VLAN regardless of whether the port is a tagged member. The PVID of the port does not change.

 

IMPORTANT

IMPORTANT:

·     For users attached to an access port, make sure the authorization VLAN assigned by the server has the untagged attribute. VLAN assignment will fail if the server issues a VLAN that has the tagged attribute.

·     When you assign VLANs to users attached to a trunk port or a MAC-based VLAN disabled hybrid port, make sure there is only one untagged VLAN. If a different untagged VLAN is assigned to a subsequent user, the user cannot pass authentication.

·     As a best practice to enhance network security, do not use the port hybrid vlan command to assign a hybrid port to an authorization VLAN as a tagged member.

 

Guest VLAN

The MAC authentication guest VLAN on a port accommodates users that have failed MAC authentication for any reason other than server unreachable. For example, the VLAN accommodates users that have entered invalid passwords.

You can deploy a limited set of network resources in the MAC authentication guest VLAN. For example, a software server for downloading software and system patches.

A hybrid port is always assigned to a MAC authentication guest VLAN as an untagged member. After the assignment, do not reconfigure the port as a tagged member in the VLAN.

Table 3 shows the way that the network access device handles guest VLANs for MAC authentication users.

Table 3 VLAN manipulation

Authentication status

VLAN manipulation

A user in the MAC authentication guest VLAN fails MAC authentication.

The user is still in the MAC authentication guest VLAN.

A user in the MAC authentication guest VLAN passes MAC authentication.

The device remaps the MAC address of the user to the authorization VLAN assigned by the authentication server.

If no authorization VLAN is configured for the user on the authentication server, the device remaps the MAC address of the user to the PVID of the port.

 

Critical VLAN

The MAC authentication critical VLAN on a port accommodates users that have failed MAC authentication because no RADIUS authentication servers are reachable. Users in a MAC authentication critical VLAN can access only network resources in the critical VLAN.

The critical VLAN feature takes effect when MAC authentication is performed only through RADIUS servers. If a MAC authentication user fails local authentication after RADIUS authentication, the user is not assigned to the critical VLAN. For more information about the authentication methods, see "Configuring AAA."

Table 4 shows the way that the network access device handles critical VLANs for MAC authentication users.

Table 4 VLAN manipulation

Authentication status

VLAN manipulation

A user fails MAC authentication because all the RADIUS servers are unreachable.

The device maps the MAC address of the user to the MAC authentication critical VLAN.

The user is still in the MAC authentication critical VLAN if the user fails MAC reauthentication because all the RADIUS servers are unreachable.

If no MAC authentication critical VLAN is configured, the device maps the MAC address of the user to the PVID of the port.

A user in the MAC authentication critical VLAN fails MAC authentication for any reason other than server unreachable.

If a guest VLAN has been configured, the device maps the MAC address of the user to the guest VLAN.

If no guest VLAN is configured, the device maps the MAC address of the user to the PVID of the port.

A user in the MAC authentication critical VLAN passes MAC authentication.

The device remaps the MAC address of the user to the authorization VLAN assigned by the authentication server.

If no authorization VLAN is configured for the user on the authentication server, the device remaps the MAC address of the user to the PVID of the access port.

 

Critical voice VLAN

The MAC authentication critical voice VLAN on a port accommodates MAC authentication voice users that have failed authentication because none of the RADIUS servers in their ISP domain are reachable.

The critical voice VLAN feature takes effect when MAC authentication is performed only through RADIUS servers. If a MAC authentication voice user fails local authentication after RADIUS authentication, the user is not assigned to the critical voice VLAN. For more information about the authentication methods, see "Configuring AAA."

Table 5 shows the way that the network access device handles critical voice VLANs for MAC authentication voice users.

Table 5 VLAN manipulation

Authentication status

VLAN manipulation

A voice user fails MAC authentication because all the RADIUS servers are unreachable.

The device maps the MAC address of the voice user to the MAC authentication critical voice VLAN.

The voice user is still in the MAC authentication critical voice VLAN if the voice user fails MAC reauthentication because all the RADIUS servers are unreachable.

If no MAC authentication critical voice VLAN is configured, the device maps the MAC address of the voice user to the PVID of the port.

A voice user in the MAC authentication critical voice VLAN fails MAC authentication for any reason other than server unreachable.

If a guest VLAN has been configured, the device maps the MAC address of the voice user to the guest VLAN.

If no guest VLAN is configured, the device maps the MAC address of the voice user to the PVID of the port.

A voice user in the MAC authentication critical voice VLAN passes MAC authentication.

The device remaps the MAC address of the voice user to the authorization VLAN assigned by the authentication server.

If no authorization VLAN is configured for the voice user on the authentication server, the device remaps the MAC address of the voice user to the PVID of the access port.

 

VSI manipulation

MAC authentication support for VXLANs

As shown in Figure 1, when the device acts as both a VXLAN VTEP and a NAS, users' service information cannot be identified by VLANs. To resolve this issue, you must configure the RADIUS server to assign VSIs to MAC authenticated users. The NAS will map a user's traffic to the VXLAN that is associated with the user's authorization VSI. The mapping criteria include the user's access VLAN, access port, and MAC address.

For information about VSIs and VXLANs, see VXLAN Configuration Guide.

Figure 1 VXLAN network diagram for MAC authentication

 

Authorization VSI

An authorization VSI is associated with a VXLAN that has network resources inaccessible to unauthenticated users.

MAC authentication supports remote VSI authorization. If the VTEP does not receive authorization VSI information for a MAC authentication user from the remote server, the user cannot access resources in any VXLAN after passing authentication. If the VTEP receives authorization VSI information for the user from the remote server, it performs the following operations:

·     Dynamically creates an Ethernet service instance according to the user's access port, VLAN, and MAC address.

·     Maps the Ethernet service instance to the authorization VSI.

The user then can access resources in the VXLAN associated with the authorization VSI.

For information about dynamic creation of Ethernet service instances, see VXLAN configuration Guide.

Guest VSI

The MAC authentication guest VSI on a port accommodates users that have failed MAC authentication for any reason other than server unreachable. For example, the VSI accommodates users with invalid passwords entered.

You can deploy a limited set of network resources in the VXLAN that is associated with the MAC authentication guest VSI. For example, a software server for downloading software and system patches.

Table 6 shows the way that the VTEP handles guest VSIs for MAC authentication users.

Table 6 VSI manipulation

Authentication status

VSI manipulation

A user fails MAC authentication for any reason other than server unreachable.

The VTEP maps the user's MAC address and access VLAN to the MAC authentication guest VSI.

A user in the MAC authentication guest VSI fails MAC authentication.

The user is still in the MAC authentication guest VSI.

A user in the MAC authentication guest VSI passes MAC authentication.

The VTEP remaps the user's MAC address and access VLAN to the authorization VSI assigned by the authentication server.

 

Critical VSI

The MAC authentication critical VSI on a port accommodates users that have failed MAC authentication because no RADIUS authentication servers are reachable. Users in a MAC authentication critical VSI can access only network resources in the VXLAN associated with this VSI.

The critical VSI feature takes effect when MAC authentication is performed only through RADIUS servers. If a MAC authentication user fails local authentication after RADIUS authentication, the user is not assigned to the critical VSI. For more information about the authentication methods, see "Configuring AAA."

Table 7 shows the way that the VTEP handles critical VSIs for MAC authentication users.

Table 7 VSI manipulation

Authentication status

VSI manipulation

A user fails MAC authentication because all the RADIUS servers are unreachable.

The VTEP maps the user's MAC address and access VLAN to the MAC authentication critical VSI.

The user is still in the MAC authentication critical VSI if the user fails MAC reauthentication because all the RADIUS servers are unreachable.

If no MAC authentication critical VSI is configured, the device logs off the user.

A user in the MAC authentication critical VSI fails MAC authentication for any reason other than server unreachable.

If a guest VSI has been configured, the VTEP maps the user's MAC address and access VLAN to the guest VSI.

If no guest VSI is configured, the VTEP logs off the user.

A user in the MAC authentication critical VSI passes MAC authentication.

The VTEP remaps the user's MAC address and access VLAN to the authorization VSI assigned by the authentication server.

 

ACL assignment

You can specify an authorization ACL in the user account of a MAC authentication user to control the user's access to network resources. After the user passes MAC authentication, the authentication server (local or remote) assigns the authorization ACL to the access port of the user for traffic filtering. Only the traffic that matches the deny rules in the ACL are rejected.

You must configure ACL rules for the authorization ACL on the access device for the ACL assignment feature.

To change the access control criteria for the user, you can use one of the following methods:

·     Modify ACL rules on the access device.

·     Specify another authorization ACL on the authentication server.

The supported authorization ACLs include basic ACLs with numbers in the range of 2000 to 2999 and advanced ACLs with numbers in the range of 3000 to 3999. For more information about ACLs, see ACL and QoS Configuration Guide.

User profile assignment

You can specify a user profile in the user account for a MAC authentication user to control the user's access to network resources. After the user passes MAC authentication, the authentication server assigns the user profile to the user to filter traffic for this user. The authentication server can be the local access device or a RADIUS server. In either case, you must configure the user profile on the access device.

To change the user's access permissions, you can use one of the following methods:

·     Modify the user profile configuration on the access device.

·     Specify another user profile for the user on the authentication server.

For more information about user profiles, see "Configuring user profiles."

Redirect URL assignment

The device supports the URL attribute assigned by a RADIUS server. During MAC authentication, the HTTP or HTTPS requests of a user are redirected to the Web interface specified by the server-assigned URL attribute. After the user passes the Web authentication, the RADIUS server records the MAC address of the user and uses a DM (Disconnect Message) to log off the user. When the user initiates MAC authentication again, it will pass the authentication and come online successfully.

To redirect the HTTPS requests of MAC authentication users, specify the HTTPS redirect listening port on the device. For more information, see HTTP redirect in Layer 3—IP Services Configuration Guide.

Blackhole MAC attribute assignment

The device supports the blackhole MAC attribute assigned by the RADIUS server through CoA messages for users that have passed MAC authentication. Upon receiving a CoA message that contains the blackhole MAC attribute for a user that has passed MAC authentication, the device performs the following operations:

1.     Logs off the user.

2.     Marks the MAC address of the user as a silent MAC address and starts a quiet timer for the MAC address.

The quiet timer is 10 minutes and is not user configurable. The device drops all packets from the MAC address after the quiet timer starts, and it will not authenticate the MAC address until the quiet timer expires.

To display silent MAC addresses, use the display mac-authentication command.

Configuration prerequisites

Before you configure MAC authentication, complete the following tasks:

1.     Configure an ISP domain and specify an AAA method. For more information, see "Configuring AAA."

¡     For local authentication, you must also create local user accounts (including usernames and passwords) and specify the lan-access service for local users.

¡     For RADIUS authentication, make sure the device and the RADIUS server can reach each other and create user accounts on the RADIUS server. If you are using MAC-based accounts, make sure the username and password for each account are the same as the MAC address of each MAC authentication user.

2.     Make sure the port security feature is disabled. For more information about port security, see "Configuring port security."

Configuration restrictions and guidelines

To make sure MAC authentication correctly operate on your network, read the MAC authentication configuration restrictions and guidelines carefully before you configure MAC authentication features.

MAC authentication-enabled port configuration restrictions

IMPORTANT

IMPORTANT:

MAC authentication is supported only on Layer 2 Ethernet interfaces and Layer 2 aggregate interfaces.

 

On Layer 2 aggregate interfaces, you can only perform VSI-related tasks, including:

·     Enable MAC authentication.

·     Configure a MAC authentication guest VSI or critical VSI.

·     Set the maximum number of concurrent MAC authentication users on a port.

When you add a Layer 2 Ethernet interface to an aggregation group, its existing MAC authentication settings are automatically removed.

After a Layer 2 Ethernet interface is added to an aggregation group, you cannot configure MAC authentication on it.

Do not delete a Layer 2 aggregate interface if the interface has online MAC authentication users.

Do not change the link type of a port when the MAC authentication guest or critical VLAN on the port has users.

If a hybrid port is configured with a MAC authentication guest or critical VSI, that port is assigned to a non-PVID VLAN always as a tagged member, regardless of whether you have configured it as a tagged or untagged member.

MAC authentication VLAN and VSI assignment restrictions

If the server assigns both an authorization VSI and authorization VLAN to a user, the device uses only the authorization VLAN.

Avoid incompatible settings on a port, as shown in Table 8.

Table 8 Settings incompatible with MAC authentication VLANs or VSIs on a port

Settings

Incompatible settings

Guest VLAN and critical VLAN settings for MAC authentication

Guest VSI and critical VSI settings for MAC authentication

802.1X guest VSI, Auth-Fail VSI, and critical VSI settings

Guest VSI and critical VSI settings for MAC authentication

Guest VLAN and critical VLAN settings for MAC authentication

802.1X guest VLAN, Auth-Fail VLAN, and critical VLAN settings

To ensure a successful authentication, you must configure the authentication server to assign authorization VLANs or VSIs to the MAC authentication users attached to a port in the following situations:

·     If the MAC authentication-enabled port is configured with the guest VLAN or critical VLAN, configure the authentication server to assign authorization VLANs to MAC authentication users.

·     If the MAC authentication-enabled port is configured with the guest VSI or critical VSI, configure the authentication server to assign authorization VSIs to MAC authentication users.

·     If both 802.1X and MAC authentication are configured on the port, be careful with the VSI settings of the two authentication features.

¡     You must configure VSI authorization for the MAC authentication users if the port has an Auth-Fail, guest, or critical VSI for 802.1X authentication.

¡     Likewise, you must configure VSI authorization for the 802.1X users if the port has a guest or critical VSI for MAC authentication.

Configuration task list

Tasks at a glance

(Required.) Enabling MAC authentication

(Optional.) Specifying a MAC authentication domain

(Optional.) Configuring the user account format

(Optional.) Configuring MAC authentication timers

(Optional.) Setting the maximum number of concurrent MAC authentication users on a port

(Optional.) Enabling MAC authentication multi-VLAN mode on a port

(Optional.) Configuring MAC authentication delay

(Optional.) Enabling parallel processing of MAC authentication and 802.1X authentication

(Optional.) Configuring a MAC authentication guest VLAN

(Optional.) Configuring a MAC authentication critical VLAN

(Optional.) Enabling the MAC authentication critical voice VLAN

(Optional.) Configuring a MAC authentication guest VSI

(Optional.) Configuring a MAC authentication critical VSI

(Optional.) Configuring periodic MAC reauthentication

(Optional.) Including user IP addresses in MAC authentication requests

(Optional.) Enabling MAC authentication offline detection

(Optional.) Enabling MAC authentication user logging

 

Enabling MAC authentication

Before enabling MAC authentication on a port, make sure the port is not added to a service loopback group.

To enable MAC authentication on a port:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enable MAC authentication globally.

mac-authentication

By default, MAC authentication is disabled globally.

3.     Enter interface view.

interface interface-type interface-number

N/A

4.     Enable MAC authentication on the port.

mac-authentication

By default, MAC authentication is disabled on a port.

 

Specifying a MAC authentication domain

By default, MAC authentication users are in the system default authentication domain. To implement different access policies for users, you can use one of the following methods to specify authentication domains for MAC authentication users:

·     Specify a global authentication domain in system view. This domain setting applies to all ports enabled with MAC authentication.

·     Specify an authentication domain for an individual port in interface view.

MAC authentication chooses an authentication domain for users on a port in this order: the port-specific domain, the global domain, and the default domain. For more information about authentication domains, see "Configuring AAA."

To specify an authentication domain for MAC authentication users:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Specify an authentication domain for MAC authentication users.

·     In system view:
mac-authentication domain domain-name

·     In interface view:

a.     interface interface-type interface-number

b.     mac-authentication domain domain-name

By default, the system default authentication domain is used for MAC authentication users.

 

Configuring the user account format

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Configure the MAC authentication user account format.

·     Use one MAC-based user account for each user:
mac-authentication user-name-format mac-address [ { with-hyphen | without-hyphen } [ lowercase | uppercase ] ]

·     Use one shared user account for all users:
mac-authentication user-name-format fixed [ account name ] [ password { cipher | simple } string ]

By default, the device uses the MAC address of a user as the username and password for MAC authentication. The MAC address is in the hexadecimal notation without hyphens, and letters are in lower case.

 

Configuring MAC authentication timers

MAC authentication uses the following timers:

·     Offline detect timer—Sets the interval that the device waits for traffic from a user before the device determines that the user is idle. If the device has not received traffic from a user before the timer expires, the device logs off that user and requests the accounting server to stop accounting for the user. This timer takes effect only when the MAC authentication offline detection feature is enabled.

As a best practice, set the MAC address aging timer to the same value as the offline detect timer. This operation prevents a MAC authenticated user from being logged off within the offline detect interval because of MAC address entry expiration.

·     Quiet timer—Sets the interval that the device must wait before the device can perform MAC authentication for a user that has failed MAC authentication. All packets from the MAC address are dropped during the quiet time. This quiet mechanism prevents repeated authentication from affecting system performance.

·     Server timeout timer—Sets the interval that the device waits for a response from a RADIUS server before the device determines that the RADIUS server is unavailable. If the timer expires during MAC authentication, the user cannot access the network.

To configure MAC authentication timers:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Configure MAC authentication timers.

mac-authentication timer { offline-detect offline-detect-value | quiet quiet-value | server-timeout server-timeout-value }

By default, the offline detect timer is 300 seconds, the quiet timer is 60 seconds, and the server timeout timer is 100 seconds.

 

Setting the maximum number of concurrent MAC authentication users on a port

Perform this task to prevent the system resources from being overused.

To set the maximum number of concurrent MAC authentication users on a port:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Set the maximum number of concurrent MAC authentication users on the port

mac-authentication max-user max-number

The default setting is 4294967295.

 

Enabling MAC authentication multi-VLAN mode on a port

The MAC authentication multi-VLAN mode prevents an authenticated online user from service interruption caused by VLAN changes on a port. When the port receives a packet sourced from the user in a VLAN not matching the existing MAC-VLAN mapping, the device neither logs off the user nor reauthenticates the user. The device creates a new MAC-VLAN mapping for the user, and traffic transmission is not interrupted. The original MAC-VLAN mapping for the user remains on the device until it dynamically ages out. As a best practice, configure this feature on hybrid or trunk ports.

This feature improves transmission of data that is vulnerable to delay and interference. It is typically applicable to IP phone users.

To enable MAC authentication multi-VLAN mode on a port:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Enable MAC authentication multi-VLAN mode.

mac-authentication host-mode multi-vlan

By default, this feature is disabled on a port. When the port receives a packet sourced from an authenticated user in a VLAN not matching the existing MAC-VLAN mapping, the device logs off and reauthenticates the user.

 

Configuring MAC authentication delay

When both 802.1X authentication and MAC authentication are enabled on a port, you can delay MAC authentication so that 802.1X authentication is preferentially triggered.

If no 802.1X authentication is triggered or 802.1X authentication fails within the delay period, the port continues to process MAC authentication.

Do not set the port security mode to mac-else-userlogin-secure or mac-else-userlogin-secure-ext when you use MAC authentication delay. The delay does not take effect on a port in either of the two modes. For more information about port security modes, see "Configuring port security."

To configure MAC authentication delay:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Enable MAC authentication delay and set the delay timer.

mac-authentication timer auth-delay auth-delay-time

By default, MAC authentication delay is disabled.

 

Enabling parallel processing of MAC authentication and 802.1X authentication

This feature enables a port that processes MAC authentication after 802.1X authentication is finished to process MAC authentication in parallel with 802.1X authentication.

When the port receives a packet from an unknown MAC address, it sends a unicast EAP-Request/Identity packet to the MAC address. After that, the port immediately processes MAC authentication without waiting for the 802.1X authentication result.

After MAC authentication succeeds, the port is assigned to the MAC authentication authorization VLAN.

·     If 802.1X authentication fails, the MAC authentication result takes effect.

·     If 802.1X authentication succeeds, the device handles the port and the MAC address based on the 802.1X authentication result.

Configuration restrictions and guidelines

When you enable parallel processing of MAC authentication and 802.1X authentication on a port, follow these restrictions and guidelines:

·     Make sure the port meets the following requirements:

¡     The port is configured with both 802.1X authentication and MAC authentication and performs MAC-based access control for 802.1X authentication.

¡     The port is enabled with the 802.1X unicast trigger.

·     For the port to perform MAC authentication before it is assigned to the 802.1X guest VLAN or guest VSI, enable new MAC-triggered 802.1X guest VLAN or VSI assignment delay.

For information about new MAC-triggered 802.1X guest VLAN or VSI assignment delay, see "Configuring 802.1X."

·     For the parallel processing feature to work correctly, do not enable MAC authentication delay on the port. This operation will delay MAC authentication after 802.1X authentication is triggered.

·     To configure both 802.1X authentication and MAC authentication on the port, use one of the following methods:

¡     Enable the 802.1X and MAC authentication features separately on the port.

¡     Enable port security on the port. The port security mode must be userlogin-secure-or-mac or userlogin-secure-or-mac-ext.

For information about port security mode configuration, see "Configuring port security."

Configuration procedure

To enable parallel processing of MAC authentication and 802.1X authentication on a port:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Enable parallel processing of MAC authentication and 802.1X authentication on the port.

mac-authentication parallel-with-dot1x

By default, this feature is disabled.

 

Configuring a MAC authentication guest VLAN

You must configure the MAC authentication guest VLAN on a hybrid port. Before you configure the MAC authentication guest VLAN on a hybrid port, complete the following tasks:

·     Enable MAC authentication globally and on the port.

·     Enable MAC-based VLAN on the port.

·     Create the VLAN to be specified as the MAC authentication guest VLAN.

·     Configure the VLAN as an untagged member on the port.

When you configure the MAC authentication guest VLAN on a port, follow the guidelines in Table 9.

Table 9 Relationships of the MAC authentication guest VLAN with other security features

Feature

Relationship description

Reference

Quiet feature of MAC authentication

The MAC authentication guest VLAN feature has higher priority.

When a user fails MAC authentication, the user can access the resources in the guest VLAN. The user's MAC address is not marked as a silent MAC address.

See "Configuring MAC authentication timers."

Super VLAN

You cannot specify a VLAN as both a super VLAN and a MAC authentication guest VLAN.

See Layer 2—LAN Switching Configuration Guide.

Port intrusion protection

The guest VLAN feature has higher priority than the block MAC action but lower priority than the shutdown port action of the port intrusion protection feature.

See "Configuring port security."

 

To configure the MAC authentication guest VLAN on a port:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Specify the MAC authentication guest VLAN on the port.

mac-authentication guest-vlan guest-vlan-id

By default, no MAC authentication guest VLAN exists.

You can configure only one MAC authentication guest VLAN on a port.

4.     (Optional.) Set the authentication interval for users in the MAC authentication guest VLAN.

mac-authentication guest-vlan auth-period period-value

The default setting is 30 seconds.

 

Configuring a MAC authentication critical VLAN

You must configure the MAC authentication critical VLAN on a hybrid port. Before you configure the MAC authentication critical VLAN on a hybrid port, complete the following tasks:

·     Enable MAC authentication globally and on the port.

·     Enable MAC-based VLAN on the port.

·     Create the VLAN to be specified as the MAC authentication critical VLAN.

·     Configure the VLAN as an untagged member on the port.

When you configure the MAC authentication critical VLAN on a port, follow the guidelines in Table 10.

Table 10 Relationships of the MAC authentication critical VLAN with other security features

Feature

Relationship description

Reference

Quiet feature of MAC authentication

The MAC authentication critical VLAN feature has higher priority.

When a user fails MAC authentication because no RADIUS authentication server is reachable, the user can access the resources in the critical VLAN. The user's MAC address is not marked as a silent MAC address.

See "Configuring MAC authentication timers."

Super VLAN

You cannot specify a VLAN as both a super VLAN and a MAC authentication critical VLAN.

See Layer 2—LAN Switching Configuration Guide.

Port intrusion protection

The critical VLAN feature has higher priority than the block MAC action but lower priority than the shutdown port action of the port intrusion protection feature.

See "Configuring port security."

 

To configure the MAC authentication critical VLAN on a port:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Specify the MAC authentication critical VLAN on the port.

mac-authentication critical vlan critical-vlan-id

By default, no MAC authentication critical VLAN exists.

You can configure only one MAC authentication critical VLAN on a port.

 

Enabling the MAC authentication critical voice VLAN

Configuration prerequisites

Before you enable the MAC authentication critical voice VLAN on a port, complete the following tasks:

·     Enable LLDP both globally and on the port.

The device uses LLDP to identify voice users. For information about LLDP, see Layer 2—LAN Switching Configuration Guide.

·     Enable voice VLAN on the port.

For information about voice VLANs, see Layer 2—LAN Switching Configuration Guide.

Configuration procedure

To enable the MAC authentication critical voice VLAN feature on a port:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Enable the MAC authentication critical voice VLAN feature on a port.

mac-authentication critical-voice-vlan

By default, the MAC authentication critical voice VLAN feature is disabled on a port.

 

Configuring a MAC authentication guest VSI

Configuration restrictions and guidelines

The MAC authentication guest VSI feature has higher priority than the quiet feature of MAC authentication. When a user fails MAC authentication, the user can access the resources in the guest VSI. The user's MAC address is not marked as a silent MAC address.

You can configure only one MAC authentication guest VSI on a port. The MAC authentication guest VSIs on different ports can be different.

Configuration prerequisites

Before you configure the MAC authentication guest VSI on a port, complete the following tasks:

·     Enable L2VPN.

·     Create the VSI to be specified as the MAC authentication guest VSI, and create a VXLAN for the VSI.

·     Make sure MAC-based traffic matching for dynamic Ethernet service instances is enabled on the port.

For more information, see VXLAN Configuration Guide.

Configuration procedure

To configure a MAC authentication guest VSI on a port:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Specify the MAC authentication guest VSI on the port.

mac-authentication guest-vsi guest-vsi-name

By default, no MAC authentication guest VSI exists on a port.

4.     (Optional.) Set the authentication interval for users in the MAC authentication guest VSI.

mac-authentication guest-vsi auth-period period-value

The default setting is 30 seconds.

 

Configuring a MAC authentication critical VSI

Configuration restrictions and guidelines

The MAC authentication critical VSI feature has higher priority than the quiet feature of MAC authentication. When a user fails MAC authentication, the user can access the resources in the critical VSI. The user's MAC address is not marked as a silent MAC address.

You can configure only one MAC authentication critical VSI on a port. The MAC authentication critical VSIs on different ports can be different.

Configuration prerequisites

Before you configure the MAC authentication critical VSI on a port, complete the following tasks:

·     Enable L2VPN.

·     Create the VSI to be specified as the MAC authentication critical VSI, and create a VXLAN for the VSI.

·     Make sure MAC-based traffic matching for dynamic Ethernet service instances is enabled on the port.

For more information, see VXLAN Configuration Guide.

Configuration procedure

To configure a MAC authentication critical VSI on a port:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Specify the MAC authentication critical VSI on the port.

mac-authentication critical vsi critical-vsi-name [ url-user-logoff ]

By default, no MAC authentication critical VSI exists on a port.

The url-user-logoff keyword enables the device to log off MAC authentication users that have been assigned authorization URLs on the port when the first user is assigned to the critical VSI.

 

Configuring periodic MAC reauthentication

Overview

Periodic MAC reauthentication reauthenticates online MAC authentication users at user-configurable reauthentication intervals. The reauthentication feature tracks the connection status of online users and updates the authorization attributes assigned by the server. The attributes include the ACL and VLAN.

By default, the device logs off online MAC authentication users if no server is reachable for MAC reauthentication. The keep-online feature keeps authenticated MAC authentication users online when no server is reachable for MAC reauthentication.

Configuration restrictions and guidelines

When you configure periodic MAC reauthentication, follow these restrictions and guidelines:

·     The server-assigned RADIUS Session-Timeout (attribute 27) and Termination-Action (attribute 29) attributes together can affect the periodic MAC reauthentication feature. To display the server-assigned Session-Timeout and Termination-Action attributes, use the display mac-authentication connection command (see Security Command Reference).

¡     If the termination action is logging off users, periodic MAC reauthentication takes effect only when the periodic reauthentication timer is shorter than the session timeout timer. If the session timeout timer is shorter, the device logs off online authenticated users when the session timeout timer expires.

¡     If the termination action is reauthenticating users, the periodic MAC reauthentication configuration on the device cannot take effect. The device reauthenticates online MAC authentication users after the server-assigned session timeout timer expires.

Support for the server configuration and assignment of session timeout timer and termination action depends on the server model.

·     You can set the periodic reauthentication timer either in system view or in interface view by using the mac-authentication timer reauth-period command. A change to the periodic reauthentication timer applies to online users only after the old timer expires.

The device selects a periodic reauthentication timer for MAC reauthentication in the following order:

a.     Server-assigned reauthentication timer.

b.     Port-specific reauthentication timer.

c.     Global reauthentication timer.

d.     Default reauthentication timer.

·     In a fast-recovery network, you can use the keep-online feature to prevent MAC authentication users from coming online and going offline frequently.

·     With the RADIUS DAS feature enabled, the device can receive the reauthentication attribute of a RADIUS authentication server through CoA messages. In this case, reauthentication will be performed regardless of whether periodic MAC reauthentication is enabled on the device. For information about RADIUS DAS configuration, see "Configuring AAA."

·     The VLANs assigned to an online user before and after reauthentication can be the same or different.

·     Any modification to the MAC authentication domain or user account format setting does not affect the reauthentication of online MAC authentication users. The modified setting takes effect only on MAC authentication users that come online after the modification.

Configuration procedure

To configure periodic MAC reauthentication:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     (Optional.) Set the global periodic MAC reauthentication timer.

mac-authentication timer reauth-period reauth-period-value

The default setting is 3600 seconds.

3.     Enter interface view.

interface interface-type interface-number

N/A

4.     Enable periodic MAC reauthentication.

mac-authentication re-authenticate

By default, periodic MAC reauthentication is disabled on a port.

5.     (Optional.) Set the periodic reauthentication timer on the port.

mac-authentication timer reauth-period reauth-period-value

By default, no periodic reauthentication timer is set on a port. The port uses the global periodic MAC reauthentication timer.

6.     (Optional.) Enable the keep-online feature for authenticated MAC authentication users on the port.

mac-authentication re-authenticate server-unreachable keep-online

By default, the keep-online feature is disabled.

 

Including user IP addresses in MAC authentication requests

Overview

IMPORTANT

IMPORTANT:

This feature can only operate in conjunction with an IMC server.

 

To avoid IP conflicts that result from changes to static IP addresses, use this feature on a port that has MAC authentication users that use static IP addresses.

This feature adds user IP addresses to the MAC authentication requests sent to the authentication server. When MAC authentication is triggered for a user, the device checks the user's IP address for invalidity.

·     If the IP address is valid, the device sends a MAC authentication request with the IP address included.

·     If the IP address is not a valid host IP address or the triggering packet does not contain an IP address, the device does not initiate MAC authentication.

·     If the packet is a DHCP packet with a source IP address of 0.0.0.0, the device sends a MAC authentication request without including the IP address. In this case, the IMC server does not examine the user IP address when it performs authentication.

Upon receipt of the authentication request that includes a user's IP address, the IMC server compares the user's IP and MAC addresses with its IP-MAC mappings.

·     If an exact match is found or if no match is found, the user passes MAC authentication. In the latter case, the server creates an IP-MAC mapping for the user.

·     If a mapping is found for the MAC address but the IP addresses do not match, the user fails the MAC authentication.

Configuration restrictions and guidelines

Do not use this feature in conjunction with the MAC authentication guest VLAN or guest VSI on a port. If the features are used together, the device cannot perform MAC authentication for a user once that user is added to the MAC authentication guest VLAN or guest VSI.

Configuration procedure

To include user IP addresses in MAC authentication requests:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Include user IP addresses in MAC authentication requests.

mac-authentication carry user-ip

By default, a MAC authentication request does not include the user IP address.

 

Enabling MAC authentication offline detection

After you enable MAC authentication offline detection on a port, the device will log off users from which no traffic is received on the port within an offline detect interval. In addition to the logoff action, the device requests the accounting server to stop accounting for the users. For more information about the offline detect timer, see "Configuring MAC authentication timers."

Disabling this feature disables the device from inspecting the online user status.

To enable MAC authentication offline detection:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enter interface view.

interface interface-type interface-number

N/A

3.     Enable MAC authentication offline detection.

mac-authentication offline-detect enable

By default, MAC authentication offline detection is enabled.

 

Enabling MAC authentication user logging

Overview

This feature enables the device to generate logs about MAC authentication users and send the logs to the information center. For the logs to be output correctly, you must also configure the information center on the device. For more information about information center configuration, see Network Management and Monitoring Configuration Guide.

Configuration restrictions and guidelines

To prevent excessive MAC authentication user log entries, use this feature only if you need to analyze abnormal MAC authentication user logins or logouts.

Configuration procedure

To enable MAC authentication user logging:

 

Step

Command

Remarks

1.     Enter system view.

system-view

N/A

2.     Enable MAC authentication user logging.

mac-authentication access-user log enable [ failed-login | logoff | successful-login ] *

By default, MAC authentication user logging is disabled.

If you do not specify any parameters, this command enables all types of MAC authentication user logs.

 

Displaying and maintaining MAC authentication

Execute display commands in any view and reset commands in user view.

 

Task

Command

Display MAC authentication information.

display mac-authentication [ interface interface-type interface-number ]

Display MAC authentication connections.

display mac-authentication connection [ open ] [ interface interface-type interface-number | slot slot-number | user-mac mac-address | user-name user-name ]

Display the MAC addresses of MAC authentication users in a type of MAC authentication VLAN or VSI.

display mac-authentication mac-address { critical-vlan | critical-vsi | guest-vlan | guest-vsi } [ interface interface-type interface-number ]

Clear MAC authentication statistics.

reset mac-authentication statistics [ interface interface-type interface-number ]

Remove users from the MAC authentication critical VLAN on a port.

reset mac-authentication critical vlan interface interface-type interface-number [ mac-address mac-address ]

Remove users from the MAC authentication critical voice VLAN on a port.

reset mac-authentication critical-voice-vlan interface interface-type interface-number [ mac-address mac-address ]

Remove users from the MAC authentication guest VLAN on a port.

reset mac-authentication guest-vlan interface interface-type interface-number [ mac-address mac-address ]

Remove users from the MAC authentication critical VSI on a port.

reset mac-authentication critical vsi interface interface-type interface-number [ mac-address mac-address ]

Remove users from the MAC authentication guest VSI on a port.

reset mac-authentication guest-vsi interface interface-type interface-number [ mac-address mac-address ]

 

MAC authentication configuration examples

Local MAC authentication configuration example

Network requirements

As shown in Figure 2, the device performs local MAC authentication on Ten-GigabitEthernet 1/0/1 to control Internet access of users.

Configure the device to meet the following requirements:

·     Detect whether a user has gone offline every 180 seconds.

·     Deny a user for 180 seconds if the user fails MAC authentication.

·     Authenticate all users in ISP domain bbb.

·     Use the MAC address of each user as the username and password for authentication. A MAC address is in the hexadecimal notation with hyphens, and letters are in lower case.

Figure 2 Network diagram

Configuration procedure

# Add a network access local user. In this example, configure both the username and password as Host A's MAC address 00-e0-fc-12-34-56.

<Device> system-view

[Device] local-user 00-e0-fc-12-34-56 class network

[Device-luser-network-00-e0-fc-12-34-56] password simple 00-e0-fc-12-34-56

# Specify the LAN access service for the user.

[Device-luser-network-00-e0-fc-12-34-56] service-type lan-access

[Device-luser-network-00-e0-fc-12-34-56] quit

# Configure ISP domain bbb to perform local authentication for LAN users.

[Device] domain bbb

[Device-isp-bbb] authentication lan-access local

[Device-isp-bbb] quit

# Enable MAC authentication on Ten-GigabitEthernet 1/0/1.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] mac-authentication

[Device-Ten-GigabitEthernet1/0/1] quit

# Specify ISP domain bbb as the MAC authentication domain.

[Device] mac-authentication domain bbb

# Configure MAC authentication timers.

[Device] mac-authentication timer offline-detect 180

[Device] mac-authentication timer quiet 180

# Configure MAC authentication to use MAC-based accounts. Each MAC address is in the hexadecimal notation with hyphens, and letters are in lower case.

[Device] mac-authentication user-name-format mac-address with-hyphen lowercase

# Enable MAC authentication globally.

[Device] mac-authentication

Verifying the configuration

# Display MAC authentication settings and statistics to verify your configuration.

[Device] display mac-authentication

Global MAC authentication parameters:

   MAC authentication     : Enabled

   User name format       : MAC address in lowercase(xx-xx-xx-xx-xx-xx)

           Username       : mac

           Password       : Not configured

   Offline detect period  : 180 s

   Quiet period           : 180 s

   Server timeout         : 100 s

   Reauth period          : 3600 s

   Authentication domain  : bbb

 Online MAC-auth wired users    : 1

 

 Silent MAC users:

          MAC address       VLAN ID  From port               Port index

          00e0-fc11-1111    8        XGE1/0/1                1

 

 Ten-GigabitEthernet1/0/1 is link-up

   MAC authentication         : Enabled

   Carry User-IP              : Disabled

   Authentication domain      : Not configured

   Auth-delay timer           : Disabled

   Periodic reauth            : Disabled

   Re-auth server-unreachable : Logoff

   Guest VLAN                 : Not configured

   Guest VLAN auth-period     : 30 s

   Critical VLAN              : Not configured

   Critical voice VLAN        : Disabled

   Host mode                  : Single VLAN

   Offline detection          : Enabled

   Authentication order       : Default

   Guest VSI                  : Not configured

   Guest VSI auth-period      : 30 s

   Critical VSI               : Not configured

   Auto-tag feature           : Disabled

   VLAN tag configuration ignoring  : Disabled

   Max online users           : 4294967295

   Authentication attempts    : successful 1, failed 0

   Current online users       : 1

          MAC address       Auth state

          00e0-fc12-3456    Authenticated

The output shows that Host A has passed MAC authentication and has come online. Host B failed MAC authentication and its MAC address is marked as a silent MAC address.

RADIUS-based MAC authentication configuration example

Network requirements

As shown in Figure 3, the device uses RADIUS servers to perform authentication, authorization, and accounting for users.

To control user access to the Internet by MAC authentication, perform the following tasks:

·     Enable MAC authentication globally and on Ten-GigabitEthernet 1/0/1.

·     Configure the device to detect whether a user has gone offline every 180 seconds.

·     Configure the device to deny a user for 180 seconds if the user fails MAC authentication.

·     Configure all users to belong to ISP domain bbb.

·     Use a shared user account for all users, with username aaa and password 123456.

Figure 3 Network diagram

Configuration procedure

1.     Make sure the RADIUS server and the access device can reach each other. (Details not shown.)

2.     Configure the RADIUS servers:

# Create a shared account for MAC authentication users. (Details not shown.)

# Set username aaa and password 123456 for the account. (Details not shown.)

3.     Configure RADIUS-based MAC authentication on the device:

# Configure a RADIUS scheme.

<Device> system-view

[Device] radius scheme 2000

[Device-radius-2000] primary authentication 10.1.1.1 1812

[Device-radius-2000] primary accounting 10.1.1.2 1813

[Device-radius-2000] key authentication simple abc

[Device-radius-2000] key accounting simple abc

[Device-radius-2000] user-name-format without-domain

[Device-radius-2000] quit

# Apply the RADIUS scheme to ISP domain bbb for authentication, authorization, and accounting.

[Device] domain bbb

[Device-isp-bbb] authentication default radius-scheme 2000

[Device-isp-bbb] authorization default radius-scheme 2000

[Device-isp-bbb] accounting default radius-scheme 2000

[Device-isp-bbb] quit

# Enable MAC authentication on Ten-GigabitEthernet 1/0/1.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] mac-authentication

[Device-Ten-GigabitEthernet1/0/1] quit

# Specify the MAC authentication domain as ISP domain bbb.

[Device] mac-authentication domain bbb

# Set MAC authentication timers.

[Device] mac-authentication timer offline-detect 180

[Device] mac-authentication timer quiet 180

# Specify username aaa and password 123456 in plain text for the account shared by MAC authentication users.

[Device] mac-authentication user-name-format fixed account aaa password simple 123456

# Enable MAC authentication globally.

[Device] mac-authentication

Verifying the configuration

# Verify the MAC authentication configuration.

[Device] display mac-authentication

Global MAC authentication parameters:

   MAC authentication     : Enabled

   Username format        : Fixed account

           Username       : aaa

           Password       : ******

   Offline detect period  : 180 s

   Quiet period           : 180 s

   Server timeout         : 100 s

   Reauth period          : 3600 s

   Authentication domain  : bbb

 Online MAC-auth wired users    : 1

 

 Silent MAC users:

          MAC address       VLAN ID  From port               Port index

 

 Ten-GigabitEthernet1/0/1  is link-up

   MAC authentication         : Enabled

   Carry User-IP              : Disabled

   Authentication domain      : Not configured

   Auth-delay timer           : Disabled

   Periodic reauth            : Disabled

   Re-auth server-unreachable : Logoff

   Guest VLAN                 : Not configured

   Guest VLAN auth-period     : 30 s

   Critical VLAN              : Not configured

   Critical voice VLAN        : Disabled

   Host mode                  : Single VLAN

   Offline detection          : Enabled

   Authentication order       : Default

   Guest VSI                  : Not configured

   Guest VSI auth-period      : 30 s

   Critical VSI               : Not configured

   Auto-tag feature           : Disabled

   VLAN tag configuration ignoring  : Disabled

   Max online users           : 4294967295

   Authentication attempts    : successful 1, failed 0

   Current online users       : 1

          MAC address       Auth state

          00e0-fc12-3456    Authenticated

ACL assignment configuration example

Network requirements

As shown in Figure 4, configure the device to meet the following requirements:

·     Use RADIUS servers to perform authentication, authorization, and accounting for users.

·     Perform MAC authentication on Ten-GigabitEthernet 1/0/1 to control Internet access.

·     Use MAC-based user accounts for MAC authentication users. Each MAC address is in the hexadecimal notation with hyphens, and letters are in lower case.

·     Use an ACL to deny authenticated users to access the FTP server at 10.0.0.1.

Figure 4 Network diagram

 

Configuration procedure

Make sure the RADIUS servers and the access device can reach each other.

1.     Configure ACL 3000 to deny packets destined for 10.0.0.1.

<Device> system-view

[Device] acl advanced 3000

[Device-acl-ipv4-adv-3000] rule 0 deny ip destination 10.0.0.1 0

[Device-acl-ipv4-adv-3000] quit

2.     Configure RADIUS-based MAC authentication on the device:

# Configure a RADIUS scheme.

[Device] radius scheme 2000

[Device-radius-2000] primary authentication 10.1.1.1 1812

[Device-radius-2000] primary accounting 10.1.1.2 1813

[Device-radius-2000] key authentication simple abc

[Device-radius-2000] key accounting simple abc

[Device-radius-2000] user-name-format without-domain

[Device-radius-2000] quit

# Apply the RADIUS scheme to an ISP domain for authentication, authorization, and accounting.

[Device] domain bbb

[Device-isp-bbb] authentication default radius-scheme 2000

[Device-isp-bbb] authorization default radius-scheme 2000

[Device-isp-bbb] accounting default radius-scheme 2000

[Device-isp-bbb] quit

# Specify the ISP domain for MAC authentication.

[Device] mac-authentication domain bbb

# Configure the device to use MAC-based user accounts. Each MAC address is in the hexadecimal notation with hyphens, and letters are in lower case.

[Device] mac-authentication user-name-format mac-address with-hyphen lowercase

# Enable MAC authentication on Ten-GigabitEthernet 1/0/1.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] mac-authentication

[Device-Ten-GigabitEthernet1/0/1] quit

# Enable MAC authentication globally.

[Device] mac-authentication

3.     Configure the RADIUS servers:

# Add a user account with 00-e0-fc-12-34-56 as both the username and password on each RADIUS server. (Details not shown.)

# Specify ACL 3000 as the authorization ACL for the user account. (Details not shown.)

Verifying the configuration

# Verify the MAC authentication configuration.

[Device] display mac-authentication

Global MAC authentication parameters:

   MAC authentication     : Enabled

   Username format        : MAC address in lowercase(xx-xx-xx-xx-xx-xx)

           Username       : mac

           Password       : Not configured

   Offline detect period  : 300 s

   Quiet period           : 60 s

   Server timeout         : 100 s

   Reauth period          : 3600 s

   Authentication domain  : bbb

 Online MAC-auth wired users    : 1

 

 Silent MAC users:

          MAC address       VLAN ID  From port               Port index

 

 Ten-GigabitEthernet1/0/1  is link-up

   MAC authentication         : Enabled

   Carry User-IP              : Disabled

   Authentication domain      : Not configured

   Auth-delay timer           : Disabled

   Periodic reauth            : Disabled

   Re-auth server-unreachable : Logoff

   Guest VLAN                 : Not configured

   Guest VLAN auth-period     : 30 s

   Critical VLAN              : Not configured

   Critical voice VLAN        : Disabled

   Host mode                  : Single VLAN

   Offline detection          : Enabled

   Authentication order       : Default

   Guest VSI                  : Not configured

   Guest VSI auth-period      : 30 s

   Critical VSI               : Not configured

   Auto-tag feature           : Disabled

   VLAN tag configuration ignoring  : Disabled

   Max online users           : 4294967295

   Authentication attempts    : successful 1, failed 0

   Current online users       : 1

          MAC address       Auth state

          00e0-fc12-3456    Authenticated

# Verify that you cannot ping the FTP server from the host.

C:\>ping 10.0.0.1

 

Pinging 10.0.0.1 with 32 bytes of data:

 

Request timed out.

Request timed out.

Request timed out.

Request timed out.

 

Ping statistics for 10.0.0.1:

   Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

The output shows that ACL 3000 has been assigned to Ten-GigabitEthernet 1/0/1 to deny access to the FTP server.

MAC authentication authorization VSI assignment configuration example

Network configuration

As shown in Figure 5, configure the device to meet the following requirements:

·     Use RADIUS servers to perform authentication, authorization, and accounting for users.

·     Perform MAC authentication on Ten-GigabitEthernet 1/0/1 to control Internet access.

·     Configure the RADIUS server to assign VSI bbb to the host when the host passes MAC authentication.

·     Authenticate all users in ISP domain 2000.

·     Use MAC-based user accounts for MAC authentication users. Each MAC address is in the hexadecimal notation with hyphens, and letters are in lower case.

Figure 5 Network diagram

 

Procedure

Make sure the RADIUS servers and the access device can reach each other.

1.     Configure the RADIUS servers:

# Configure the RADIUS servers to provide authentication, authorization, and accounting services. (Details not shown.)

# Add a user account with d4-85-64-be-c6-3e as both the username and password on each RADIUS server. (Details not shown.)

# Specify VSI bbb as the authorization VSI for the user account. (Details not shown.)

 

 

NOTE:

If an H3C ADCAM server is used for authentication and authorization, configure VSIs on the server. The server will assign these VSIs to the device. You do not need to configure VSIs on the device.

 

2.     Configure RADIUS-based MAC authentication on the device:

# Configure a RADIUS scheme.

<Device> system-view

[Device] radius scheme bbb

[Device-radius-bbb] primary authentication 10.1.1.1

[Device-radius-bbb] primary accounting 10.1.1.2

[Device-radius-bbb] key authentication simple bbb

[Device-radius-bbb] key accounting simple bbb

[Device-radius-bbb] user-name-format without-domain

[Device-radius-bbb] quit

# Apply the RADIUS scheme to ISP domain 2000 for authentication, authorization, and accounting.

[Device] domain 2000

[Device-isp-2000] authentication lan-access radius-scheme bbb

[Device-isp-2000] authorization lan-access radius-scheme bbb

[Device-isp-2000] accounting lan-access radius-scheme bbb

[Device-isp-2000] quit

# Enable MAC authentication on Ten-GigabitEthernet 1/0/1.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] mac-authentication

# Enable the MAC match mode for dynamic Ethernet service instances on Ten-GigabitEthernet 1/0/1.

[Device-Ten-GigabitEthernet1/0/1] mac-based ac

[Device-Ten-GigabitEthernet1/0/1] quit

# Enable L2VPN.

[Device] l2vpn enable

# Create a VSI named bbb and the associated VXLAN.

[Device] vsi bbb

[Device-vsi-bbb] vxlan 5

[Device-vsi-bbb-vxlan-5] quit

# Specify the ISP domain for MAC authentication.

[Device] mac-authentication domain 2000

# Configure the device to use MAC-based user accounts. Each MAC address is in the hexadecimal notation with hyphens, and letters are in lower case.

[Device] mac-authentication user-name-format mac-address with-hyphen lowercase

# Enable MAC authentication globally.

[Device] mac-authentication

Verifying the configuration

# Verify that VSI bbb is assigned to the MAC authentication user after the user passes authentication.

[Device] display mac-authentication connection

Slot ID: 1

User MAC address: d485-64be-c63e

Access interface: Ten-GigabitEthernet1/0/1

Username: d4-85-64-be-c6-3e

Authentication domain: 2000

Initial VLAN: 1

Authorization untagged VLAN: N/A

Authorization tagged VLAN: N/A

Authorization VSI name: bbb

Authorization ACL ID: N/A

Authorization user profile: N/A

Authorization URL:  N/A

Termination action: N/A

Session timeout period: N/A

Online from: 2016/06/13 09:06:37

Online duration: 0h 0m 35s

 

Total connections: 1

# Verify that a dynamic AC is created for MAC address d485-64be-c63e.

[Device] display l2vpn forwarding ac verbose

VSI Name: bbb

  Interface: XGE1/0/1  Service Instance: 1

    Link ID      : 0

    Access Mode  : VLAN

    Encapsulation: untagged

    Type         : Dynamic (MAC-based)

    MAC address  : d485-64be-c63e

 

  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
All Support
  • Become a Partner
  • Partner Resources
  • Partner Business Management
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us
新华三官网