The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of MAC authentication.

Example: Configuring local MAC authentication

Network configuration

As shown in Figure 1, the device performs local MAC authentication on Twenty-FiveGigE 1/0/1 to control Internet access of users.

Configure the device to meet the following requirements:

· Detect whether a user has gone offline every 180 seconds.

· Deny a user for 180 seconds if the user fails MAC authentication.

· Authenticate all users in ISP domain bbb.

· Use the MAC address of each user as both the username and password for authentication. The MAC addresses are in hexadecimal notation with hyphens, and letters are in lower case. In this example, both the username and password are 08-00-27-00-98-d2.

Figure 1 Network diagram

Applicable hardware and software versions

The following matrix shows the hardware and software versions to which this configuration example is applicable:

Hardware	Software version
S6550X-HI switch series	Release 1213P51 and later
S6880 switch series	Release 1213P51 and later
S9820-8M switch	Release 1213P51 and later
S5580X-HI switch series	Release 1213P50 and later
S5580X-EI switch series	Release 1213P50 and later
S5580S-EI switch series	Release 1213P50 and later

Restrictions and guidelines

· To avoid valid users from being blocked, do not enable MAC authentication globally before you finish all settings.

· When you create a local user, the username and password must match the user account policy for MAC authentication. If MAC-based accounts are used, make sure the username and password of each user account are the same as the MAC address of the corresponding MAC authentication user.

Procedures

# Add a network access user, set both the username and password to the MAC address of the host, and allow the user to use the LAN access service.

<Device> system-view

[Device] local-user 08-00-27-00-98-d2 class network

[Device-luser-network-08-00-27-00-98-d2] password simple 08-00-27-00-98-d2

[Device-luser-network-08-00-27-00-98-d2] service-type lan-access

[Device-luser-network-08-00-27-00-98-d2] quit

# Configure ISP domain bbb to use local authentication for LAN users.

[Device] domain bbb

[Device-isp-bbb] authentication lan-access local

[Device-isp-bbb] quit

# Specify ISP domain bbb as the global MAC authentication domain.

[Device] mac-authentication domain bbb

# Configure MAC authentication timers.

[Device] mac-authentication timer offline-detect 180

[Device] mac-authentication timer quiet 180

# Use the MAC address of each user as both the username and password for MAC authentication. The MAC addresses are in hexadecimal notation with hyphens, and letters are in lower case.

[Device] mac-authentication user-name-format mac-address with-hyphen lowercase

# Enable MAC authentication on interface Twenty-FiveGigE 1/0/1.

[Device] interface twenty-fivegige 1/0/1

[Device-Twenty-FiveGigE1/0/1] mac-authentication

[Device-Twenty-FiveGigE1/0/1] quit

# Enable MAC authentication globally.

[Device] mac-authentication

Verifying the configuration

# Display MAC authentication settings and statistics.

<Device> display mac-authentication

Global MAC authentication parameters:

MAC authentication : Enabled

Authentication method : PAP

Username format : MAC address in lowercase(xx-xx-xx-xx-xx-xx)

Username : mac

Password : Not configured

MAC range accounts : 0

MAC address Mask Username

Offline detect period : 180 s

Quiet period : 180 s

Server timeout : 100 s

Reauth period : 3600 s

User aging period for critical VLAN : 1000 s

User aging period for critical VSI : 1000 s

User aging period for guest VLAN : 1000 s

User aging period for guest VSI : 1000 s

User aging period for critical microsegment: 1000 s

Authentication domain : bbb

HTTP proxy port list : Not configured

HTTPS proxy port list : Not configured

Online MAC-auth wired users : 1

Silent MAC users:

MAC address VLAN ID From port Port index

Twenty-FiveGigE1/0/1 is link-up

MAC authentication : Enabled

Carry User-IP : Disabled

Authentication domain : Not configured

Auth-delay timer : Disabled

Periodic reauth : Disabled

Re-auth server-unreachable : Logoff

Guest VLAN : Not configured

Guest VLAN reauthentication : Enabled

Guest VLAN auth-period : 30 s

Critical VLAN : Not configured

Critical voice VLAN : Disabled

Host mode : Single VLAN

Offline detection : Enabled

Authentication order : Default

User aging : Enabled

Server-recovery online-user-sync : Disabled

Guest VSI : Not configured

Guest VSI reauthentication : Enabled

Guest VSI auth-period : 30 s

Critical VSI : Not configured

Critical microsegment ID : Not configured

URL user logoff : No

Auto-tag feature : Disabled

VLAN tag configuration ignoring : Disabled

Max online users : 4294967295

Authentication attempts : successful 1, failed 0

Current online users : 1

MAC address Auth state

0800-2700-98d2 Authenticated

Configuration files

mac-authentication

mac-authentication timer offline-detect 180

mac-authentication timer quiet 180

mac-authentication domain bbb

mac-authentication user-name-format mac-address with-hyphen lowercase

domain bbb

authentication lan-access local

local-user 08-00-27-00-98-d2 class network

password cipher $c$3$rTXB/eL1h+bXc/t2nyQOrhDMC0PWfyiPb93BqMCK+JFYwvn5

service-type lan-access

authorization-attribute user-role network-operator

interface Twenty-FiveGigE1/0/1

mac-authentication

Example: Configuring MAC authentication with authorization VSI assignment

Network configuration

As shown in Figure 2:

· Configure the device to use the RADIUS servers to perform authentication, authorization, and accounting for the user on the host that is connected to Twenty-FiveGigE 1/0/1.

· Enable MAC authentication on Twenty-FiveGigE 1/0/1 to control Internet access.

· Configure the RADIUS servers to assign VSI bbb to the user when the user passes MAC authentication. After that, the user can access resources in the VXLAN created on the VSI. In this example, the VXLAN is VXLAN 5.

· Authenticate the user in ISP domain 2000.

· Use the MAC address of the host as both the username and password for MAC authentication. The MAC address is in hexadecimal notation with hyphens, and letters are in lower case. In this example, both the username and password are d4-85-64-be-c6-3e.

IMC acts as the RADIUS servers.

Figure 2 Network diagram

Analysis

· For the device to use IMC as the RADIUS servers for user authentication, authorization, and accounting, perform the following tasks on IMC:

a. Add the device to IMC as an access device.

b. Add an access policy.

c. Add an access service and specify the access policy in the access service.

d. Add an access user and specify the access service for the access user.

· For the device to perform RADIUS-based authentication, authorization, and accounting for the MAC authentication access user, configure AAA settings on the device, including ISP domain settings and RADIUS scheme settings.

· To assign a VSI to the user after the user passes authentication and allow the user to access resources in the VXLAN created on the VSI, perform the following tasks:

¡ On IMC, specify the VSI for the user when you add an access policy for the user.

¡ On the device, create the VSI and its VXLAN.

Applicable hardware and software versions

The following matrix shows the hardware and software versions to which this configuration example is applicable:

Hardware	Software version
S6550X-HI switch series	Release 1213P51 and later
S6880 switch series	Release 1213P51 and later
S9820-8M switch	Release 1213P51 and later
S5580X-HI switch series	Release 1213P50 and later
S5580X-EI switch series	Release 1213P50 and later
S5580S-EI switch series	Release 1213P50 and later

Restrictions and guidelines

· To avoid valid users from being blocked, do not enable MAC authentication globally before you finish all settings.

· When you add an access user on IMC, make sure the user account on IMC matches the MAC authentication user account policy on the device. If MAC-based accounts are used, make sure the username and password of each user account are the same as the MAC address of the corresponding MAC authentication user.

· In standard RADIUS protocol, the authentication port on RADIUS servers is UDP port 1812. If an H3C device is used as a RADIUS server, the authentication port on the RADIUS server is UDP port 1645.

Procedures

If an ADCAM server is used for authentication and authorization, configure VSIs on the server. The server will assign these VSIs to the device. You do not need to configure VSIs on the device.

Configuring the RADIUS server

This example uses IMC PLAT 7.3 (E0506), IMC EIA 7.3 (E0503), and IMC EIP 7.3 (E0503) to describe the procedure.

Adding the device to the IMC Platform as an access device

1. Log in to IMC.

2. Click the User tab.

3. From the navigation pane, select User Access Policy > Access Device Management > Access Device.

4. Click Add.

5. On the page that opens, configure access device parameters.

a. Set the ports for authentication and accounting to 1812 and 1813, respectively.

b. Select H3C (General) from the Access Device Type list.

c. Set the shared key to expert for secure authentication and accounting communication.

d. Select an access device from the device list or manually add an access device. In this example, the IP address of the access device is 10.1.1.2.

e. Use the default values for other parameters.

f. Click OK.

The IP address of the access device specified on IMC must be the same as the source IP address of the RADIUS packets sent from the device. On the device, the source IP address is chosen in the following order:

a. IP address specified by using the nas-ip command.

b. IP address specified by using the radius nas-ip command.

c. IP address of the outbound interface (the default).

In this example, the device uses the IP address of the outbound interface as the source IP address of RADIUS packets.

Figure 3 Adding an access device

Adding an access policy

1. Click the User tab.

2. From the navigation pane, select User Access Policy > Access Policy.

3. Click Add.

4. On the page that opens, configure access policy parameters.

a. Enter access policy name MACauth.

b. Set the name of the VSI to be deployed to bbb.

c. Configure other parameters as needed.

d. Click OK.

Figure 4 Adding an access policy

Adding an access service

1. Click the User tab.

2. From the navigation pane, select User Access Policy > Access Service.

3. Click Add.

4. On the page that opens, configure access service parameters.

a. Enter service name MACauth Service and set the service suffix to 2000. The service suffix is the authentication domain for the MAC authentication user.

IMPORTANT:

With the service suffix configured, you must configure the device to send usernames that include the domain name to the RADIUS servers.

b. Select MACauth from the Default Access Policy list.

c. Configure other parameters as needed.

d. Click OK.

Figure 5 Adding an access service

Adding an access user

1. Click the User tab.

2. From the navigation pane, select Access User > Access User.

3. Click Add.

4. On the page that opens, configure access user parameters.

a. Select the user or add a user named test.

b. Enter account name d4-85-64-be-c6-3e and password d4-85-64-be-c6-3e.

c. Select MACauth Service in the Access Service area.

d. Configure other parameters as needed.

e. Click OK.

Figure 6 Adding an access user

Configuring the device

# Configure a RADIUS scheme.

IMPORTANT:

With the service suffix configured on IMC, you must configure the device to send usernames that include the domain name to the RADIUS servers. By default, the device includes the domain name in the usernames sent to a RADIUS server.

<Device> system-view

[Device] radius scheme bbb

[Device-radius-bbb] primary authentication 10.1.1.1

[Device-radius-bbb] primary accounting 10.1.1.2

[Device-radius-bbb] key authentication simple expert

[Device-radius-bbb] key accounting simple expert

[Device-radius-bbb] user-name-format with-domain

[Device-radius-bbb] quit

# Configure ISP domain 2000.

[Device] domain 2000

[Device-isp-2000] authentication lan-access radius-scheme bbb

[Device-isp-2000] authorization lan-access radius-scheme bbb

[Device-isp-2000] accounting lan-access radius-scheme bbb

[Device-isp-2000] quit

# Enable MAC authentication on interface Twenty-FiveGigE 1/0/1.

[Device] interface twenty-fivegige 1/0/1

[Device-Twenty-FiveGigE1/0/1] mac-authentication

# Enable MAC-based traffic match mode for dynamic Ethernet service instances on interface Twenty-FiveGigE 1/0/1.

[Device-Twenty-FiveGigE1/0/1] mac-based ac

[Device-Twenty-FiveGigE1/0/1] quit

# Enable L2VPN.

[Device] l2vpn enable

# Create a VSI named bbb and the associated VXLAN.

[Device] vsi bbb

[Device-vsi-bbb] vxlan 5

[Device-vsi-bbb-vxlan-5] quit

[Device-vsi-bbb] quit

# Specify ISP domain 2000 as the global MAC authentication domain.

[Device] mac-authentication domain 2000

# Use the MAC address of each user as both the username and password for MAC authentication. The MAC addresses are in hexadecimal notation with hyphens, and letters are in lower case.

[Device] mac-authentication user-name-format mac-address with-hyphen lowercase

# Enable MAC authentication globally.

[Device] mac-authentication

Verifying the configuration

# Verify that VSI bbb is assigned to the MAC authentication user after the user passes authentication.

[Device] display mac-authentication connection

Total connections: 1

Slot ID: 1

User MAC address: d485-64be-c63e

Access interface: Twenty-FiveGigE1/0/1

Username: d4-85-64-be-c6-3e

User access state: Successful

Authentication domain: 2000

IPv4 address: 192.168.1.1

IPv6 address: 2000:0:0:0:1:2345:6789:abcd

Initial VLAN: 1

Authorization untagged VLAN: N/A

Authorization tagged VLAN: N/A

Authorization VSI: bbb

Authorization microsegment ID: N/A

Authorization ACL ID: N/A

Authorization user profile: N/A

Authorization CAR:

Average input rate: 102400 bps

Peak input rate: 204800 bps

Average output rate: 102400 bps

Peak output rate: 204800 bps

Authorization URL: N/A

Termination action: N/A

Session timeout period: N/A

Offline detection: 100 sec (server-assigned)

Online from: 2016/06/13 09:06:37

Online duration: 0h 0m 35s

# Verify that a dynamic AC is created for MAC address d485-64be-c63e.

[Device] display l2vpn forwarding ac verbose

VSI Name: bbb

Interface: WGE1/0/1 Service Instance: 1

Link ID : 0

Access Mode : VLAN

Encapsulation: untagged

Type : Dynamic (MAC-based)

MAC address : d485-64be-c63e

Configuration files

radius scheme bbb

primary authentication 10.1.1.1

primary accounting 10.1.1.2

key authentication cipher $c$3$+zuETC3Y0LHiW3bxzBb+UNEuWlxHkQ==

key accounting cipher $c$3$2b8hx6mbWlnMMQY82TeUzgh0VnWXbg==

user-name-format with-domain

domain 2000

authentication lan-access radius-scheme bbb

accounting lan-access radius-scheme bbb

interface Twenty-FiveGigE1/0/1

mac-authentication

mac-based ac

vsi bbb

vxlan 5

l2vpn enable

mac-authentication domain 2000

mac-authentication user-name-format mac-address with-hyphen lowercase

mac-authentication

Example: Configuring MAC authentication with ACL assignment

Network configuration

As shown in Figure 7:

· Configure the device to use the RADIUS servers to perform authentication, authorization, and accounting for the user on the host that is connected to Twenty-FiveGigE 1/0/1.

· Enable MAC authentication on Twenty-FiveGigE 1/0/1 to control Internet access.

· Use the MAC address of the host as both the username and password for MAC authentication. The MAC address is in hexadecimal notation with hyphens, and letters are in lower case.

· Use an ACL to deny the user to access the FTP server at 10.0.0.1 after the user passes authentication.

IMC acts as the RADIUS servers.

Figure 7 Network diagram

Analysis

· For the device to use IMC as the RADIUS servers for user authentication, authorization, and accounting, perform the following tasks on IMC:

a. Add the device to IMC as an access device.

b. Add an access policy.

c. Add an access service and specify the access policy in the access service.

d. Add an access user and specify the access service for the access user.

· To use an ACL to restrict the user's network access behaviors after the user passes authentication, perform the following tasks:

¡ On IMC, specify the ACL number for the user when you add an access policy for the user.

¡ On the device, create the ACL and configure its rules.

Applicable hardware and software versions

The following matrix shows the hardware and software versions to which this configuration example is applicable:

Hardware	Software version
S6550X-HI switch series	Release 1213P51 and later
S6880 switch series	Release 1213P51 and later
S9820-8M switch	Release 1213P51 and later
S5580X-HI switch series	Release 1213P50 and later
S5580X-EI switch series	Release 1213P50 and later
S5580S-EI switch series	Release 1213P50 and later

Restrictions and guidelines

· To avoid valid users from being blocked, do not enable MAC authentication globally before you finish all settings.

· In standard RADIUS protocol, the authentication port on RADIUS servers is UDP port 1812. If an H3C device is used as a RADIUS server, the authentication port on the RADIUS server is UDP port 1645.