MAC authentication controls network access by authenticating source MAC addresses on a port. The feature does not require client software, and users do not have to enter a username and password for network access. The device initiates a MAC authentication process when it detects an unknown source MAC address on a MAC authentication-enabled port. If the MAC address passes authentication, the user can access authorized network resources. If the authentication fails, the device marks the MAC address as a silent MAC address, drops the packet, and starts a quiet timer. The device drops all subsequent packets from the MAC address within the quiet time. The quiet mechanism avoids repeated authentication during a short time.

User account policies

MAC authentication supports the following user account policies:

· Global user account policy, which can be either of the following options:

¡ MAC-based user account policy—One MAC-based user account for each user. As shown in Figure 1, the access device uses the source MAC addresses in packets as the usernames and passwords of users for MAC authentication. This policy is suitable for an insecure environment.

NOTE:

MAC-based user account policy also supports configuring a password shared by all MAC-based user accounts.

¡ Shared user account policy—One shared user account for all users. You specify one username and password (which are not necessarily a MAC address) for all MAC authentication users on the access device, as shown in Figure 2. This policy is suitable for a secure environment.

· MAC range-specific user account policy—One shared user account for users in a specific MAC address range. You specify one username and password (which are not necessarily a MAC address) for users in a specific MAC address range on the access device, as shown in Figure 3. For example, you can specify a username and password for users with a specific OUI for MAC authentication.

IMPORTANT:

· You can use global and MAC range-specific user account policies together. For users in a MAC address range, the MAC range-specific user account settings have higher priority than the global user account settings.

· If a RADIUS server is used for MAC authentication, you must create the user accounts on the RADIUS server based on the user account policy on the access device.

Figure 1 MAC-based user account policy

Figure 2 Shared user account policy (global)

Figure 3 Shared user account policy (specific to MAC address ranges)

‌

Authentication methods

You can perform MAC authentication on the access device (local authentication) or through a RADIUS server.

For more information about configuring local authentication and RADIUS authentication, see "Configuring AAA."

RADIUS authentication

If MAC-based accounts are used, the access device by default sends the source MAC address of a packet as the username and password to the RADIUS server for authentication. If a password is configured for MAC-based accounts, the access device sends the configured password as the password to the RADIUS server.

If a shared account is used, the access device sends the shared account username and password to the RADIUS server for authentication.

The access device and the RADIUS server use Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP) for communication.

Local authentication

If MAC-based accounts are used, the access device by default uses the source MAC address of a packet as the username and password to search the local account database for a match. If a password is configured for MAC-based accounts, the device uses the configured password to search the local account database for a match.

If a shared account is used, the access device uses the shared account username and password to search the local account database for a match.

VLAN assignment

Authorization VLAN

The authorization VLAN controls the access of a MAC authentication user to authorized network resources. The device supports authorization VLANs assigned locally or by a remote server.

IMPORTANT:

Only remote servers can assign tagged authorization VLANs.

‌

Remote VLAN authorization

In remote VLAN authorization, you must configure an authorization VLAN for a user on the remote server. After the user authenticates to the server, the server assigns authorization VLAN information to the device. Then, the device assigns the user access port to the authorization VLAN as a tagged or untagged member.

The device supports assignment of the following authorization VLAN information by the remote server:

· VLAN ID.

· VLAN name, which must be the same as the VLAN description on the access device.

· A string of VLAN IDs and VLAN names.

In the string, some VLANs are represented by their IDs, and some VLANs are represented by their names.

· VLAN group name.

For more information about VLAN groups, see Layer 2—LAN Switching Configuration Guide.

· VLAN ID with a suffix of t or u.

The t and u suffixes require the device to assign the access port to the VLAN as a tagged or untagged member, respectively. For example, 2u indicates assigning the port to VLAN 2 as an untagged member.

If a VLAN name or VLAN group name is assigned, the device converts the information into a VLAN ID before VLAN assignment.

IMPORTANT:

For a VLAN represented by its VLAN name to be assigned successfully, you must make sure the VLAN has been created on the device.

To assign VLAN IDs with suffixes, make sure the user access port is a hybrid or trunk port.

‌

IMPORTANT:

To ensure a successful assignment, the authorization VLANs assigned by the remote server cannot be any of the following types:

· Dynamically learned VLANs.

· Reserved VLANs.

· Super VLANs.

‌

If the server assigns a group of VLANs, the access device selects a VLAN as described in Table 1.

Table 1 Authorization VLAN selection from a group of VLANs

VLAN information	Authorization VLAN selection
VLANs by IDs VLANs by names VLAN group name	The device selects an authorization VLAN from the VLAN group for a user according to the following rules: · If the port does not have online users, the device selects the VLAN with the lowest ID. · If the port has online users, the device examines the VLAN group for the VLAN of the online users. If the VLAN is found, the VLAN is assigned to the user as the authorization VLAN. If the VLAN is not found, VLAN authorization fails.
VLAN IDs with suffixes	1. The device selects the leftmost VLAN ID without a suffix, or the leftmost VLAN ID suffixed by u as an untagged VLAN, whichever is more leftmost. 2. The device assigns the untagged VLAN to the port as the PVID, and it assigns the remaining as tagged VLANs. If no untagged VLAN is assigned, the PVID of the port does not change. The port permits traffic from these tagged and untagged VLANs to pass through. For example, the authentication server sends the string 1u 2t 3 to the access device for a user. The device assigns VLAN 1 as an untagged VLAN and all remaining VLANs (including VLAN 3) as tagged VLANs. VLAN 1 becomes the PVID.

VLAN information

Authorization VLAN selection

VLANs by IDs

VLANs by names

VLAN group name

The device selects an authorization VLAN from the VLAN group for a user according to the following rules:

· If the port does not have online users, the device selects the VLAN with the lowest ID.

· If the port has online users, the device examines the VLAN group for the VLAN of the online users. If the VLAN is found, the VLAN is assigned to the user as the authorization VLAN. If the VLAN is not found, VLAN authorization fails.

VLAN IDs with suffixes

1. The device selects the leftmost VLAN ID without a suffix, or the leftmost VLAN ID suffixed by u as an untagged VLAN, whichever is more leftmost.

2. The device assigns the untagged VLAN to the port as the PVID, and it assigns the remaining as tagged VLANs. If no untagged VLAN is assigned, the PVID of the port does not change. The port permits traffic from these tagged and untagged VLANs to pass through.

For example, the authentication server sends the string 1u 2t 3 to the access device for a user. The device assigns VLAN 1 as an untagged VLAN and all remaining VLANs (including VLAN 3) as tagged VLANs. VLAN 1 becomes the PVID.

‌

Local VLAN authorization

To perform local VLAN authorization for a user, specify the VLAN ID in the authorization attribute list of the local user account for that user. For each local user, you can specify only one authorization VLAN ID. The user access port is assigned to the VLAN as an untagged member.

IMPORTANT:

Local VLAN authorization does not support assignment of tagged VLANs.

‌

For more information about local user configuration, see "Configuring AAA."

Authorization VLAN manipulation on a MAC authentication-enabled port

Table 2 describes the way the network access device handles authorization VLANs (except for the VLANs specified with suffixes) for MAC authenticated users on a port.

Table 2 VLAN manipulation

Port type	VLAN manipulation
· Access port · Trunk port · Hybrid port	· The device assigns the port to the first authenticated user's authorization VLAN and sets the VLAN as the PVID if that authorization VLAN has the untagged attribute. · If the authorization VLAN has the tagged attribute, the device assigns the port to the authorization VLAN without changing its PVID. NOTE: The tagged attribute is supported only on trunk and hybrid ports.

Port type

VLAN manipulation

· Access port

· Trunk port

· Hybrid port

· The device assigns the port to the first authenticated user's authorization VLAN and sets the VLAN as the PVID if that authorization VLAN has the untagged attribute.

· If the authorization VLAN has the tagged attribute, the device assigns the port to the authorization VLAN without changing its PVID.

NOTE:

The tagged attribute is supported only on trunk and hybrid ports.

IMPORTANT:

· If the users are attached to a port whose link type is access, make sure the authorization VLAN assigned by the server has the untagged attribute. VLAN assignment will fail if the server issues a VLAN that has the tagged attribute.

· When you assign VLANs to users attached to a trunk port or a hybrid port, make sure there is only one untagged VLAN. If a different untagged VLAN is assigned to a subsequent user, the user cannot pass authentication.

· As a best practice to enhance network security, do not use the port hybrid vlan command to assign a hybrid port to an authorization VLAN as a tagged member.

The VLAN assigned by the server to a user as an authorization VLAN might have been configured on the user access port but with a different tagging mode. For example, the server assigns an authorization VLAN with the tagged attribute, but the same VLAN configured on the port has the untagged attribute. In this situation, the VLAN settings that take effect on the user depend on the link type of the port.

· If the link type of the port is access or trunk, the authorization VLAN settings assigned by the server always take effect on the user as long as the user is online. After the user goes offline, the VLAN settings on the port take effect.

· If the link type of the port is hybrid, the VLAN settings configured on the port take effect. For example, the server assigns VLAN 30 with the untagged attribute to a user on the hybrid port. However, VLAN 30 has been configured on the port with the tagged attribute by using the port hybrid vlan tagged command. Then, the VLAN has the tagged attribute on the port.

For a MAC authenticated user to access the network on a hybrid port when no authorization VLAN is configured for the user, perform one of the following tasks:

· If the port receives tagged authentication packets from the user in a VLAN, use the port hybrid vlan command to configure the port as a tagged member in the VLAN.

· If the port receives untagged authentication packets from the user in a VLAN, use the port hybrid vlan command to configure the port as an untagged member in the VLAN.

ACL assignment

You can specify an authorization ACL for a MAC authentication user on a remote server or the access device to control the user's access to network resources. After the user passes MAC authentication, the server or access device assigns the authorization ACL to the user access port. Then, the port permits or drops the matching traffic for the user depending on the rules in the ACL.

The device supports assignment of static and dynamic authorization ACLs.

· Assignment of static authorization ACLs—Static ACLs can be assigned by a RADIUS server or the access device. When the server or access device assigns a static ACL to a user, it assigns only the ACL number. You must manually create the ACL and configure its rules on the access device.

To change the access permissions of a user, use one of the following methods:

¡ Modify ACL rules in the authorization ACL on the access device.

¡ Assign another ACL to the user as the authorization ACL from the RADIUS server or the access device.

Static ACLs and their rules can be manually deleted from the access device.

· Assignment of dynamic authorization ACLs—Dynamic ACLs and their rules are automatically deployed by a RADIUS server, which are not configurable on the access device. Dynamic ACLs can only be named ACLs. After the device receives a server-deployed dynamic ACL and its rules, it automatically creates the ACL and configures its rules.

If a dynamic ACL assigned by the server to a user has the same name as a static ACL, the dynamic ACL cannot be issued and the user cannot come online.

A dynamic ACL and its rules are automatically deleted from the access device after all its users go offline.

Dynamic ACLs and their rules cannot be manually modified or deleted on the access device. To display information about dynamic ACLs and their rules, use the display mac-authentication connection or display acl command.

‌

IMPORTANT:

The supported authorization ACLs include the following types:

· Basic ACLs, which are numbered in the range of 2000 to 2999.

· Advanced ACLs, which are numbered in the range of 3000 to 3999.

· Layer 2 ACLs, which are numbered in the range of 4000 to 4999.

· User-defined ACLs, which are numbered in the range of 5000 to 5999.

For an authorization ACL to take effect, make sure the ACL exists with rules and none of the rules contains the counting, established, fragment, source-mac, cos, dest-mac, lsap, vxlan, or logging keyword.

For more information about ACLs, see ACL and QoS Configuration Guide.

‌

User profile assignment

You can specify a user profile in the user account for a MAC authentication user on the authentication server to control the user's access to network resources. After the user passes MAC authentication, the authentication server assigns the user profile to the user to filter traffic for this user.

The authentication server can be the local access device or a RADIUS server. In either case, the server only specifies the user profile name. You must configure the user profile on the access device.

To change the user's access permissions, you can use one of the following methods:

· Modify the user profile configuration on the access device.

· Specify another user profile for the user on the authentication server.

For more information about user profiles, see "Configuring user profiles."

Redirect URL assignment

The device supports the URL attribute assigned by a RADIUS server. During MAC authentication, the HTTP or HTTPS requests of a user are redirected to the Web interface specified by the server-assigned URL attribute. After the user passes the Web authentication, the RADIUS server records the MAC address of the user and uses a DM (Disconnect Message) to log off the user. When the user initiates MAC authentication again, it will pass the authentication and come online successfully.

By default, the device listens to port 6654 for HTTPS requests to be redirected. To change the redirect listening port number, see configuring HTTP redirect in Layer 3—IP Services Configuration Guide.

Blackhole MAC attribute assignment

The device supports the blackhole MAC attribute assigned by the RADIUS authentication server through CoA messages for users that have passed MAC authentication. Upon receiving a CoA message that contains the blackhole MAC attribute for a user that has passed MAC authentication, the device performs the following operations:

1. Logs off the user.

2. Marks the MAC address of the user as a silent MAC address and starts a quiet timer for the MAC address.

The quiet timer is 10 minutes and is not user configurable. The device drops all packets from the MAC address after the quiet timer starts, and it will not authenticate the MAC address until the quiet timer expires.

To display silent MAC addresses, use the display mac-authentication command.

Periodic MAC reauthentication

Periodic MAC reauthentication tracks the connection status of online users, and updates the authorization attributes assigned by the RADIUS server. The attributes include the ACL and VLAN.

The device reauthenticates online MAC authentication users at the periodic reauthentication interval when the periodic MAC reauthentication feature is enabled. The interval is controlled by a timer and the timer is user configurable. A change to the periodic reauthentication timer applies to online MAC authentication users only after the old timer expires and the MAC authentication users pass authentication.

The server-assigned RADIUS Session-Timeout (attribute 27) and Termination-Action (attribute 29) attributes together can affect the periodic MAC reauthentication feature. To display the server-assigned Session-Timeout and Termination-Action attributes, use the display mac-authentication connection command.

· If the termination action is to log off users, periodic MAC reauthentication takes effect only when the periodic reauthentication timer is shorter than the session timeout timer. If the session timeout timer is shorter, the device logs off online authenticated users when the session timeout timer expires.

· If the termination action is to reauthenticate users, the periodic MAC reauthentication configuration on the device cannot take effect. The device reauthenticates online MAC authentication users after the server-assigned session timeout timer expires.

If no session timeout timer is assigned by the server, whether the device performs periodic MAC reauthentication depends on the periodic MAC reauthentication configuration on the device. Support for the assignment of Session-Timeout and Termination-Action attributes depends on the server model.

With the RADIUS DAS feature enabled, the device immediately reauthenticates a user upon receiving a CoA message that carries the reauthentication attribute from a RADIUS authentication server. In this case, reauthentication will be performed regardless of whether periodic MAC reauthentication is enabled on the device. For more information about RADIUS DAS configuration, see "Configuring AAA."

By default, the device logs off online MAC authentication users if no server is reachable for MAC reauthentication. The keep-online feature keeps authenticated MAC authentication users online when no server is reachable for MAC reauthentication.

The VLANs assigned to an online user before and after reauthentication can be the same or different.

Restrictions: Software version and feature compatibility

MAC authentication is supported only in Release 6616 and later.

Restrictions and guidelines: MAC authentication configuration

When you configure MAC authentication on an interface, follow these restrictions and guidelines:

· MAC authentication is supported only on Layer 2 Ethernet interfaces and Layer 2 aggregate interfaces.

· If you add a Layer 2 Ethernet interface to an aggregation group, the MAC authentication settings configured on it will not take effect until it is removed from the aggregation group.

· Do not delete a Layer 2 aggregate interface if the interface has online MAC authentication users.

· MAC authentication is mutually exclusive with service loopback groups.

¡ You cannot enable MAC authentication on a port already in a service loopback group.

¡ You cannot add a MAC authentication-enabled port to a service loopback group.

If the MAC address that has failed authentication is a static MAC address or a MAC address that has passed any security authentication, the device does not mark the MAC address as a silent address.

MAC authentication tasks at a glance

To configure MAC authentication, perform the following tasks:

1. Enabling MAC authentication

2. Configure basic MAC authentication features

¡ Specifying a MAC authentication method

¡ Specifying a MAC authentication domain

¡ Configuring user account policy

¡ (Optional.) Configuring MAC authentication timers

¡ (Optional.) Configuring periodic MAC reauthentication

3. (Optional.) Configuring other MAC authentication features

¡ Configuring MAC authentication offline detection

¡ Enabling online user synchronization for MAC authentication

¡ Setting the maximum number of concurrent MAC authentication users on a port

¡ Enabling MAC authentication multi-VLAN mode on a port

Perform this task to not reauthenticate online users when VLAN changes occur on a port.

¡ Configuring MAC authentication delay

¡ Including user IP addresses in MAC authentication requests

¡ Logging off MAC authentication users

¡ Enabling MAC authentication user logging

Prerequisites for MAC authentication

Before you configure MAC authentication, complete the following tasks:

1. Make sure the port security feature is disabled. For more information about port security, see "Configuring port security."

2. Configure an ISP domain and specify an AAA method. For more information, see "Configuring AAA."

¡ For local authentication, you must also create local user accounts (including usernames and passwords) and specify the lan-access service for local users.

¡ For RADIUS authentication, create user accounts on the RADIUS server. Make sure the device and the RADIUS server can reach each other and use consistent user account policy.

Enabling MAC authentication

Restrictions and guidelines

For MAC authentication to take effect on a port, you must enable this feature globally and on the port.

MAC authentication cannnot take effect on a port if the device has run out of ACL resources when you perform either of the following operations:

· Enable MAC authentication on the port while MAC authentication has been enabled globally.

· Enable MAC authentication globally in system while MAC authentication has been enabled on the port.

Procedure

1. Enter system view.

system-view

2. Enable MAC authentication globally.

mac-authentication

By default, MAC authentication is disabled globally.

3. Enter interface view.

interface interface-type interface-number

4. Enable MAC authentication on the port.

mac-authentication

By default, MAC authentication is disabled on a port.

Specifying a MAC authentication method

About this task

RADIUS-based MAC authentication supports the following authentication methods:

· PAP—Transports usernames and passwords in plain text. The authentication method applies to scenarios that do not require high security.

· CHAP—Transports usernames in plain text and passwords in encrypted form over the network. CHAP is more secure than PAP.

Restrictions and guidelines

The device must use the same authentication method as the RADIUS server.

Procedure

1. Enter system view.

system-view

2. Specify an authentication method for MAC authentication.

mac-authentication authentication-method { chap | pap }

By default, the device uses PAP for MAC authentication.

Specifying a MAC authentication domain

About this task

By default, MAC authentication users are in the system default authentication domain. To implement different access policies for users, you can use one of the following methods to specify authentication domains for MAC authentication users:

· Specify a global authentication domain in system view. This domain setting applies to all ports enabled with MAC authentication.

· Specify an authentication domain for an individual port in interface view.

MAC authentication chooses an authentication domain for users on a port in this order: the port-specific domain, the global domain, and the default domain. For more information about authentication domains, see "Configuring AAA."

Procedure

1. Enter system view.

system-view

2. Specify an authentication domain for MAC authentication users.

¡ In system view:

mac-authentication domain domain-name

¡ In interface view:

interface interface-type interface-number

mac-authentication domain domain-name

By default, the system default authentication domain is used for MAC authentication users.

Configuring user account policy

Restrictions and guidelines

For users in a MAC address range, the MAC address range-specific user account has higher priority than the global user account settings.

You can configure a maximum of 16 MAC address ranges. However, you must make sure the MAC address ranges do cannot overlap.

If you configure user account settings multiple times for the same MAC address range, the most recent configuration overwrites the previous configuration.

The MAC range-specific accounts apply only to unicast MAC addresses.

· If you specify a MAC address range that contains only multicast MAC addresses, execution of this command will fail.

· If you specify a MAC address range that contains both unicast and multicast MAC addresses, the command takes effect only on unicast MAC addresses.

Procedure

1. Enter system view.

system-view

2. Configure the global MAC authentication user account policy.

¡ Use one MAC-based user account for each user.

mac-authentication user-name-format mac-address [ { with-hyphen | without-hyphen } [ lowercase | uppercase ] ] [ password { cipher | simple } string ]

¡ Use one shared user account for all users.

mac-authentication user-name-format fixed [ account name ] [ password { cipher | simple } string ]

By default, the device uses the MAC address of each user as both the username and password for MAC authentication. The MAC addresses are in hexadecimal notation without hyphens, and letters are in lower case.

3. Specify one shared user account specific to a MAC address range.

mac-authentication mac-range-account mac-address mac-address mask { mask | mask-length } account name password { cipher | simple } string

By default, no username or password is configured specific to a MAC address range. The global user account policy applies to the users.

Configuring MAC authentication timers

About this task

MAC authentication uses the following timers:

· Offline detect timer—Sets the interval that the device must wait for traffic from a user before the device determines that the user is idle. If the device has not received traffic from a user before the timer expires, the device logs off that user and requests the accounting server to stop accounting for the user. This timer takes effect only when the MAC authentication offline detection feature is enabled.

As a best practice, set the MAC address aging timer to the same value as the offline detect timer. This operation prevents a MAC authenticated user from being logged off within the offline detect interval because of MAC address entry expiration.

· Quiet timer—Sets the interval that the device must wait before the device can perform MAC authentication for a user that has failed MAC authentication. All packets from the MAC address are dropped during the quiet time. This quiet mechanism prevents repeated authentication from affecting system performance.

· Server timeout timer—Sets the interval that the device waits for a response from a RADIUS server before the device determines that the RADIUS server is unavailable. If the timer expires during MAC authentication, the user fails MAC authentication.

Restrictions and guidelines

To avoid forced logoff before the server timeout timer expires, set the server timeout timer to a value that is lower than or equal to the product of the following values:

· The maximum number of RADIUS packet transmission attempts set by using the retry command in RADIUS scheme view.

· The RADIUS server response timeout timer set by using the timer response-timeout command in RADIUS scheme view.

For information about setting the maximum number of RADIUS packet transmission attempts and the RADIUS server response timeout timer, see "Configuring AAA."

Procedure

1. Enter system view.

system-view

2. Configure MAC authentication timers.

mac-authentication timer { offline-detect offline-detect-value | quiet quiet-value | server-timeout server-timeout-value }

By default, the offline detect timer is 300 seconds, the quiet timer is 60 seconds, and the server timeout timer is 100 seconds.

Configuring periodic MAC reauthentication

Restrictions and guidelines

The device selects a periodic reauthentication timer for MAC reauthentication in the following order:

1. Server-assigned reauthentication timer.

2. Port-specific reauthentication timer.

3. Global reauthentication timer.

4. Default reauthentication timer.

Modification to the MAC authentication domain, MAC authentication method, or user account format setting does not affect the reauthentication of online MAC authentication users. The modified setting takes effect only on MAC authentication users that come online after the modification.

If periodic reauthentication is triggered for a user while that user is waiting for online synchronization, the system performs online synchronization and does not perform reauthentication for the user.

Procedure

1. Enter system view.

system-view

2. Set the periodic MAC reauthentication timer.

¡ Set a global periodic reauthentication timer.

mac-authentication timer reauth-period reauth-period-value

The default setting is 3600 seconds.

¡ Execute the following commands in sequence to set a port-specific periodic reauthentication timer:

interface interface-type interface-number

mac-authentication timer reauth-period reauth-period-value

quit

By default, no periodic MAC reauthentication timer is set on a port. The port uses the global periodic MAC reauthentication timer.

3. Enter interface view.

interface interface-type interface-number

4. Enable periodic MAC reauthentication.

mac-authentication re-authenticate

By default, periodic MAC reauthentication is disabled on a port.

5. (Optional.) Enable the keep-online feature for MAC authenticated users on the port.

mac-authentication re-authenticate server-unreachable keep-online

By default, the keep-online feature is disabled. The device logs off online MAC authentication users if no server is reachable for MAC reauthentication.

In a fast-recovery network, you can use the keep-online feature to prevent MAC authentication users from coming online and going offline frequently.

Configuring MAC authentication offline detection

About this task

Enable MAC authentication offline detection to detect idle users on a port. If the port has not received traffic from a user when the offline detect timer expires, the device logs off that user and requests the accounting server to stop accounting for the users. For information about setting the offline detect timer in system view, see "Configuring MAC authentication timers."

Disabling this feature disables the device from inspecting the online user status.

In addition to port-based MAC authentication offline detection, you can configure offline detection parameters on a per-user basis, as follows:

· Set an offline detect timer specific to a user and control whether to use the ARP snooping or ND snooping table to determine the offline state of the user.

¡ If the ARP snooping or ND snooping table is used, the device searches the ARP snooping or ND snooping table before it checks for traffic from the user within the detection interval. If a matching ARP snooping or ND snooping entry is found, the device resets the offline detect timer and the user stays online. If the offline detect timer expires because the device has not found a matching snooping entry for the user or received traffic from the user, the device disconnects the user.

¡ If the ARP or ND snooping table is not used, the device disconnects the user if it has not received traffic from that user before the offline detect timer expires.

When disconnecting the user, the device also notifies the RADIUS server (if any) to stop user accounting.

· Skip offline detection for the user. You can choose this option if the user is a dumb terminal. A dumb terminal might fail to come online again after it is logged off by the offline detection feature.

The device uses the offline detection settings for a user in the following sequence:

1. User-specific offline detection settings.

2. Offline detection settings assigned to the user by the RADIUS server. The settings include the offline detect timer, use of the ARP or ND snooping table in offline detection, and whether to ignore offline detection.

3. Port-based offline detection settings.

Restrictions and guidelines

For the user-specific offline detection feature to take effect on a user, make sure the MAC authentication offline detection feature is enabled on the user's access port.

The user-specific offline detection settings take effect on the online users immediately after they are configured.

If you enable MAC authentication offline detection on a Layer 2 aggregate interface, delay exists for the device to log off an idle user.

Procedure

1. Enter system view.

system-view

2. (Optional.) Configure MAC authentication offline detection for a user.

mac-authentication offline-detect mac-address mac-address { ignore | timer offline-detect-value [ check-arp-or-nd-snooping ] }

By default, offline detection settings configured on access ports take effect and the offline detect timer set in system view is used.

3. Enter interface view.

interface interface-type interface-number

4. Enable MAC authentication offline detection.

mac-authentication offline-detect enable

By default, MAC authentication offline detection is enabled on a port.

Enabling online user synchronization for MAC authentication

About this task

IMPORTANT:

This feature takes effect only when the device uses an IMC RADIUS server to authenticate MAC authentication users.

‌

To ensure that the RADIUS server maintains the same online MAC authentication user information as the device after the server state changes from unreachable to reachable, use this feature.

This feature synchronizes online MAC authentication user information between the device and the RADIUS server when the RADIUS server state is detected having changed from unreachable to reachable.

When synchronizing online MAC authentication user information on a port with the RADIUS server, the device initiates MAC authentication in turn for each authenticated online MAC authentication user to the RADIUS server.

If synchronization fails for an online user, the device logs off that user unless the failure occurs because the server has become unreachable again.

Restrictions and guidelines

To have this feature take effect, you must use it in conjunction with the RADIUS server status detection feature, which is configurable with the radius-server test-profile command. For more information about the RADIUS server status detection feature, see "Configuring AAA."

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Enable online user synchronization for MAC authentication.

mac-authentication server-recovery online-user-sync

By default, online user synchronization for MAC authentication is disabled.

Setting the maximum number of concurrent MAC authentication users on a port

About this task

Perform this task to prevent the system resources from being overused.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Set the maximum number of concurrent MAC authentication users on the port.

mac-authentication max-user max-number

The default setting is 4294967295.

Enabling MAC authentication multi-VLAN mode on a port

About this task

By default, MAC authentication single-VLAN mode applies on a port. In this mode, traffic from an online user cannot be sent in different VLANs on a port without service interruption. To accommodate applications that are sensitive to delay or service interruption in a multi-VLAN environment, for example, IP phones, enable MAC authentication multi-VLAN mode.

In multi-VLAN mode, the port forwards traffic from a user in different VLANs without reauthentication if the user has been authenticated and come online in any VLAN on the port. Free of reauthentication, traffic from an online user can be sent in different VLANs without delay or service interruption.

In single-VLAN mode, the port reauthenticates an online user when traffic received from that user contains a VLAN tag different from the VLAN in which the user was authenticated. The authentication process differs depending on the MAC move setting in port security and the authorization VLAN assignment status, as follows:

· If no authorization VLAN has been assigned to the online user, the device first logs off the user and then reauthenticates the user in the new VLAN.

· If the online user has been assigned an authorization VLAN, the device handles the user depending on the MAC move setting in port security.

¡ If MAC move is disabled in port security, the user cannot pass authentication and come online from the new VLAN until after it goes offline from the port.

¡ If MAC move is enabled in port security, the user can pass authentication on the new VLAN and come online without having to first go offline from the port. After the user passes authentication on the new VLAN, the original authentication session of the user is deleted from the port.

To enable the port security MAC move feature, use the port-security mac-move permit command.

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Enable MAC authentication multi-VLAN mode.

mac-authentication host-mode multi-vlan

By default, MAC authentication operates in single-VLAN mode on a port.

Configuring MAC authentication delay

About this task

When both 802.1X authentication and MAC authentication are enabled on a port, you can delay MAC authentication so that 802.1X authentication is preferentially triggered.

If no 802.1X authentication is triggered or 802.1X authentication fails within the delay period, the port continues to process MAC authentication.

Restrictions and guidelines

Do not set the port security mode to mac-else-userlogin-secure or mac-else-userlogin-secure-ext when you use MAC authentication delay. The delay does not take effect on a port in either of the two modes. For more information about port security modes, see "Configuring port security."

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Enable MAC authentication delay and set the delay timer.

mac-authentication timer auth-delay time

By default, MAC authentication delay is disabled.

Including user IP addresses in MAC authentication requests

About this task

IMPORTANT:

This feature can only operate in conjunction with an IMC server.

‌

To avoid IP conflicts that result from changes to static IP addresses, use this feature on a port that has MAC authentication users with static IP addresses.

This feature adds user IP addresses to the MAC authentication requests sent to the authentication server. When MAC authentication is triggered for a user, the device checks the user's IP address for invalidity.

· If the IP address is valid, the device sends a MAC authentication request with the IP address included.

· If the IP address is not a valid host IP address or the triggering packet does not contain an IP address, the device does not initiate MAC authentication.

· If the packet is a DHCP packet with a source IP address of 0.0.0.0, the device sends a MAC authentication request without including the IP address. In this case, the IMC server does not examine the user IP address when it performs authentication.

Upon receipt of the authentication request that includes a user's IP address, the IMC server compares the user's IP and MAC addresses with its local IP-MAC mappings.

· If an exact match is found or if no match is found, the user passes MAC authentication. In the latter case, the server creates an IP-MAC mapping for the user.

· If a mapping is found for the MAC address but the IP addresses do not match, the user fails the MAC authentication.

Restrictions and guidelines

You can specify an ACL to identify source IP addresses that can or cannot trigger MAC authentication. When you configure the ACL, follow these guidelines:

· The specified ACL number represents an IPv4 ACL and an IPv6 ACL with the same number. For example, if the ACL number is 2000, you specify both IPv4 ACL 2000 and IPv6 ACL 2000. The IPv4 ACL and the IPv6 ACL will be used to process IPv4 packets and IPv6 packets, respectively.

· Use permit rules to identify source IP addresses that are valid for MAC authentication. Use deny rules to identify source IP addresses that cannot trigger MAC authentication.

· In the rules, only the action keyword (permit or deny) and the source IP match criterion can take effect.

· As a best practice, configure a deny rule to exclude the IPv6 IP addresses that start with fe80 from triggering MAC authentication.

· If you configure permit rules, add a deny all rule at the bottom of the ACL.

IMPORTANT:

If the user host is configured with IPv6, the device might receive packets that contain an IPv6 link-local address, which starts with fe80. MAC authentication failure or incorrect MAC-IP binding will occur if this address is used in MAC authentication. To avoid these issues, configure a basic ACL to exclude the IPv6 IP addresses that start with fe80.

‌

Procedure

1. Enter system view.

system-view

2. Enter interface view.

interface interface-type interface-number

3. Include user IP addresses in MAC authentication requests.

mac-authentication carry user-ip [ exclude-ip acl acl-number ]

By default, a MAC authentication request does not include the user IP address.

Logging off MAC authentication users

About this task

Perform this task to log off specified MAC authentication users and clear information about these users from the device. These users must perform MAC authentication to come online again.

Procedure

To log off MAC authentication users, execute the following command in user view:

reset mac-authentication access-user [ interface interface-type interface-number | mac mac-address | username username | vlan vlan-id ]

Enabling MAC authentication user logging

About this task

This feature enables the device to generate logs about MAC authentication users and send the logs to the information center. For the logs to be output correctly, you must also configure the information center on the device. For more information about information center configuration, see Network Management and Monitoring Configuration Guide.

Restrictions and guidelines

To prevent excessive MAC authentication user log entries, use this feature only if you need to analyze abnormal MAC authentication user logins or logouts.

Procedure

1. Enter system view.

system-view

2. Enable MAC authentication user logging.

mac-authentication access-user log enable [ failed-login | logoff | successful-login ] *

By default, MAC authentication user logging is disabled.

If you do not specify any parameters, this command enables all types of MAC authentication user logs.

Display and maintenance commands for MAC authentication

Execute display commands in any view and reset commands in user view.

Task	Command
Display MAC authentication information.	display mac-authentication [ interface interface-type interface-number ]
Display MAC authentication connections.	display mac-authentication connection [ open ] [ interface interface-type interface-number \| slot slot-number \| user-mac mac-address \| user-name user-name ]
Clear MAC authentication statistics.	reset mac-authentication statistics [ interface interface-type interface-number ]

MAC authentication configuration examples

Example: Configuring local MAC authentication

Network configuration

As shown in Figure 4, the device performs local MAC authentication on HundredGigE 1/1/1 to control Internet access of users.

Configure the device to meet the following requirements:

· Detect whether a user has gone offline every 180 seconds.

· Deny a user for 180 seconds if the user fails MAC authentication.

· Authenticate all users in ISP domain bbb.

· Use the MAC address of each user as both the username and password for authentication. The MAC addresses are in hexadecimal notation with hyphens, and letters are in lower case.

Figure 4 Network diagram

‌

Procedure

# Add a network access local user. In this example, configure both the username and password as Host A's MAC address 08-00-27-12-34-56.

<Device> system-view

[Device] local-user 08-00-27-12-34-56 class network

[Device-luser-network-08-00-27-12-34-56] password simple 08-00-27-12-34-56

# Specify the LAN access service for the user.

[Device-luser-network-08-00-27-12-34-56] service-type lan-access

[Device-luser-network-08-00-27-12-34-56] quit

# Configure ISP domain bbb to perform local authentication for LAN users.

[Device] domain bbb

[Device-isp-bbb] authentication lan-access local

[Device-isp-bbb] quit

# Enable MAC authentication on HundredGigE 1/1/1.

[Device] interface hundredgige 1/1/1

[Device-HundredGigE1/1/1] mac-authentication

[Device-HundredGigE1/1/1] quit

# Specify ISP domain bbb as the MAC authentication domain.

[Device] mac-authentication domain bbb

# Configure MAC authentication timers.

[Device] mac-authentication timer offline-detect 180

[Device] mac-authentication timer quiet 180

# Use the MAC address of each user as both the username and password for MAC authentication. The MAC addresses are in hexadecimal notation with hyphens, and letters are in lower case.

[Device] mac-authentication user-name-format mac-address with-hyphen lowercase

# Enable MAC authentication globally.

[Device] mac-authentication

Verifying the configuration

# Display MAC authentication settings and statistics to verify your configuration.

[Device] display mac-authentication

Global MAC authentication parameters:

MAC authentication : Enabled

Authentication method : PAP

User name format : MAC address in lowercase(xx-xx-xx-xx-xx-xx)

Username : mac

Password : Not configured

Offline detect period : 180 s

Quiet period : 180 s

Server timeout : 100 s

Reauth period : 3600 s

User aging period for critical VLAN : 1000 s

User aging period for guest VLAN : 1000 s

Authentication domain : bbb

Online MAC-auth wired users : 1

Silent MAC users:

MAC address VLAN ID From port Port index

0800-2711-1111 8 HGE1/1/1 1

HundredGigE1/1/1 is link-up

MAC authentication : Enabled

Carry User-IP : Disabled

Authentication domain : Not configured

Auth-delay timer : Disabled

Periodic reauth : Disabled

Re-auth server-unreachable : Logoff

Guest VLAN : Not configured

Guest VLAN reauthentication : Enabled

Guest VLAN auth-period : 30 s

Critical VLAN : Not configured

Critical voice VLAN : Disabled

Host mode : Single VLAN

Offline detection : Enabled

Authentication order : Default

User aging : Enabled

Server-recovery online-user-sync : Enabled

Auto-tag feature : Disabled

VLAN tag configuration ignoring : Disabled

Max online users : 4294967295

Authentication attempts : successful 1, failed 0

Current online users : 1

MAC address Auth state

0800-2712-3456 Authenticated

The output shows that Host A has passed MAC authentication and has come online. Host B failed MAC authentication and its MAC address is marked as a silent MAC address.

Example: Configuring RADIUS-based MAC authentication

Network configuration

As shown in Figure 5, the device uses RADIUS servers to perform authentication, authorization, and accounting for users. The RADIUS servers use the CHAP authentication method.

To control user access to the Internet by MAC authentication, perform the following tasks:

· Enable MAC authentication globally and on HundredGigE 1/1/1.

· Configure the device to use CHAP for MAC authentication.

· Configure the device to detect whether a user has gone offline every 180 seconds.

· Configure the device to deny a user for 180 seconds if the user fails MAC authentication.

· Configure all users to belong to ISP domain bbb.

· Use a shared user account for all users, with username aaa and password 123456TESTplat&!TESTplat&!.

Figure 5 Network diagram

‌

Procedure

Make sure the RADIUS servers and the access device can reach each other.

1. Configure the RADIUS servers to provide authentication, authorization, and accounting services. Create a shared account with username aaa and password 123456TESTplat&!TESTplat&! for MAC authentication users. (Details not shown.)

2. Configure RADIUS-based MAC authentication on the device:

# Configure a RADIUS scheme.

<Device> system-view

[Device] radius scheme 2000

[Device-radius-2000] primary authentication 10.1.1.1 1812

[Device-radius-2000] primary accounting 10.1.1.2 1813

[Device-radius-2000] key authentication simple abc

[Device-radius-2000] key accounting simple abc

[Device-radius-2000] user-name-format without-domain

[Device-radius-2000] quit

# Specify CHAP as the authentication method for MAC authentication.

[Device] mac-authentication authentication-method chap

# Apply the RADIUS scheme to ISP domain bbb for authentication, authorization, and accounting.

[Device] domain bbb

[Device-isp-bbb] authentication default radius-scheme 2000

[Device-isp-bbb] authorization default radius-scheme 2000

[Device-isp-bbb] accounting default radius-scheme 2000

[Device-isp-bbb] quit

# Enable MAC authentication on HundredGigE 1/1/1.

[Device] interface hundredgige 1/1/1

[Device-HundredGigE1/1/1] mac-authentication

[Device-HundredGigE1/1/1] quit

# Specify the MAC authentication domain as ISP domain bbb.

[Device] mac-authentication domain bbb

# Set MAC authentication timers.

[Device] mac-authentication timer offline-detect 180

[Device] mac-authentication timer quiet 180

# Specify username aaa and password 123456TESTplat&!TESTplat&! in plain text for the account shared by MAC authentication users.

[Device] mac-authentication user-name-format fixed account aaa password simple 123456TESTplat&!TESTplat&!

# Enable MAC authentication globally.

[Device] mac-authentication

Verifying the configuration

# Verify the MAC authentication configuration.

[Device] display mac-authentication

Global MAC authentication parameters:

MAC authentication : Enabled

Authentication method : CHAP

Username format : Fixed account

Username : aaa

Password : ******

Offline detect period : 180 s

Quiet period : 180 s

Server timeout : 100 s

Reauth period : 3600 s

User aging period for critical VLAN : 1000 s

User aging period for guest VLAN : 1000 s

Authentication domain : bbb

Online MAC-auth wired users : 1

Silent MAC users:

MAC address VLAN ID From port Port index

HundredGigE1/1/1 is link-up

MAC authentication : Enabled

Carry User-IP : Disabled

Authentication domain : Not configured

Auth-delay timer : Disabled

Periodic reauth : Disabled

Re-auth server-unreachable : Logoff

Guest VLAN : Not configured

Guest VLAN reauthentication : Enabled

Guest VLAN auth-period : 30 s

Critical VLAN : Not configured

Critical voice VLAN : Disabled

Host mode : Single VLAN

Offline detection : Enabled

Authentication order : Default

User aging : Enabled

Server-recovery online-user-sync : Enabled

Auto-tag feature : Disabled

VLAN tag configuration ignoring : Disabled

Max online users : 4294967295

Authentication attempts : successful 1, failed 0

Current online users : 1

MAC address Auth state

0800-2712-3456 Authenticated

Example: Configuring ACL assignment for MAC authentication

Network configuration

As shown in Figure 6, configure the device to meet the following requirements:

· Use RADIUS servers to perform authentication, authorization, and accounting for users.

· Perform MAC authentication on HundredGigE 1/1/1 to control Internet access.

· Use the MAC address of each user as both the username and password for MAC authentication. The MAC addresses are in hexadecimal notation with hyphens, and letters are in lower case.

· Use an ACL to deny authenticated users to access the FTP server at 10.0.0.1.

Figure 6 Network diagram

‌

Procedure

Make sure the RADIUS servers and the access device can reach each other.

1. Configure the RADIUS servers:

# Configure the RADIUS servers to provide authentication, authorization, and accounting services. (Details not shown.)

# Add a user account with 08-00-27-12-34-56 as both the username and password on each RADIUS server. (Details not shown.)

# Specify ACL 3000 as the authorization ACL for the user account. (Details not shown.)

2. Configure ACL 3000 to deny packets destined for 10.0.0.1 on the device.

<Device> system-view

[Device] acl advanced 3000

[Device-acl-ipv4-adv-3000] rule 0 deny ip destination 10.0.0.1 0

[Device-acl-ipv4-adv-3000] quit

3. Configure RADIUS-based MAC authentication on the device:

# Configure a RADIUS scheme.

[Device] radius scheme 2000

[Device-radius-2000] primary authentication 10.1.1.1 1812

[Device-radius-2000] primary accounting 10.1.1.2 1813

[Device-radius-2000] key authentication simple abc

[Device-radius-2000] key accounting simple abc

[Device-radius-2000] user-name-format without-domain

[Device-radius-2000] quit

# Apply the RADIUS scheme to an ISP domain for authentication, authorization, and accounting.

[Device] domain bbb

[Device-isp-bbb] authentication default radius-scheme 2000

[Device-isp-bbb] authorization default radius-scheme 2000

[Device-isp-bbb] accounting default radius-scheme 2000

[Device-isp-bbb] quit

# Specify the ISP domain for MAC authentication.

[Device] mac-authentication domain bbb

# Use the MAC address of each user as both the username and password for MAC authentication. The MAC addresses are in hexadecimal notation with hyphens, and letters are in lower case.

[Device] mac-authentication user-name-format mac-address with-hyphen lowercase

# Enable MAC authentication on HundredGigE 1/1/1.

[Device] interface hundredgige 1/1/1

[Device-HundredGigE1/1/1] mac-authentication

[Device-HundredGigE1/1/1] quit

# Enable MAC authentication globally.

[Device] mac-authentication

Verifying the configuration

# Verify the MAC authentication configuration.

[Device] display mac-authentication

Global MAC authentication parameters:

MAC authentication : Enable

Authentication method : PAP

Username format : MAC address in lowercase(xx-xx-xx-xx-xx-xx)

Username : mac

Password : Not configured

Offline detect period : 300 s

Quiet period : 60 s

Server timeout : 100 s

Reauth period : 3600 s

User aging period for critical VLAN : 1000 s

User aging period for guest VLAN : 1000 s

Authentication domain : bbb

Online MAC-auth wired users : 1

Silent MAC users:

MAC address VLAN ID From port Port index

HundredGigE1/1/1 is link-up

MAC authentication : Enabled

Carry User-IP : Disabled

Authentication domain : Not configured

Auth-delay timer : Disabled

Periodic reauth : Disabled

Re-auth server-unreachable : Logoff

Guest VLAN : Not configured

Guest VLAN reauthentication : Enabled

Guest VLAN auth-period : 30 s

Critical VLAN : Not configured

Critical voice VLAN : Disabled

Host mode : Single VLAN

Offline detection : Enabled

Authentication order : Default

User aging : Enabled

Server-recovery online-user-sync : Enabled

Auto-tag feature : Disabled

VLAN tag configuration ignoring : Disabled

Max online users : 4294967295

Authentication attempts : successful 1, failed 0

Current online users : 1

MAC address Auth state

0800-2712-3456 Authenticated

# Verify that you cannot ping the FTP server from the host.

C:\>ping 10.0.0.1

Pinging 10.0.0.1 with 32 bytes of data:

Request timed out.

Ping statistics for 10.0.0.1:

Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

The output shows that ACL 3000 has been assigned to HundredGigE 1/1/1 to deny access to the FTP server.

08-Security Configuration Guide

Configuring MAC authentication

Authentication methods

RADIUS authentication

Local authentication

VLAN assignment

Remote VLAN authorization

Local VLAN authorization

Authorization VLAN manipulation on a MAC authentication-enabled port

Blackhole MAC attribute assignment

Restrictions and guidelines

Procedure

About this task

About this task

Procedure

Configuring user account policy

Restrictions and guidelines

Procedure

About this task

Restrictions and guidelines

Procedure

Restrictions and guidelines

Procedure

About this task

Restrictions and guidelines

Procedure

About this task

Restrictions and guidelines

Procedure

About this task

Procedure

About this task

Procedure

About this task

Restrictions and guidelines

Procedure

Including user IP addresses in MAC authentication requests

About this task

Restrictions and guidelines

Procedure

About this task

Procedure

About this task

Restrictions and guidelines

Procedure

Network configuration

Procedure

Verifying the configuration

Network configuration

Procedure

Verifying the configuration

Network configuration

Procedure

Verifying the configuration

Cloud & AI

InterConnect

Intelligent Terminal Products

Product Support Services

Technical Service Solutions

Resource Center

Policy

Online Help

Become a Partner

Partner Resources

Partner Business Management

Company Information

News & Events

Contact Us