Contents

MAC authentication commands· 1

display mac-authentication· 1

display mac-authentication connection· 4

mac-authentication· 7

mac-authentication access-user log enable· 8

mac-authentication domain· 9

mac-authentication re-authenticate server-unreachable keep-online· 10

mac-authentication timer 11

mac-authentication user-name-format 12

port-security mac-move permit 13

reset mac-authentication access-user 14

reset mac-authentication statistics· 15

 

MAC authentication commands

display mac-authentication

Use display mac-authentication to display MAC authentication settings and statistics.

Syntax

display mac-authentication [ interface interface-type interface-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Parameters

interface interface-type interface-number: Specifies a port by its type and number. If the specified port is not enabled with MAC authentication, this command displays only global MAC authentication information.

Usage guidelines

If you do not specify any parameters, this command displays all MAC authentication information including the global settings, port-specific settings, MAC authentication statistics, and online user statistics.

Examples

# Display all MAC authentication settings and statistics.

<Sysname> display mac-authentication

Global MAC authentication parameters:

   MAC authentication     : Enabled

   User name format       : MAC address in lowercase(xx-xx-xx-xx-xx-xx)

           Username       : mac

           Password       : Not configured

   Offline detect period  : 300 s

   Quiet period           : 60 s

   Server timeout         : 100 s

   Authentication domain  : Not configured, use default domain

 Online MAC-auth wired users    : 1

 

 Silent MAC users:

          MAC address       VLAN ID  From port                   Port index

          0001-0000-0001    100      GigabitEthernet1/0/2        21

          0001-0000-0003    12       GigabitEthernet1/0/4        301

 

 GigabitEthernet1/0/1  is link-up

   MAC authentication         : Enabled

   Carry User-IP              : Disabled

   Authentication domain      : Not configured

   Auth-delay timer           : Enabled

       Auth-delay period      : 60 s

   Re-auth server-unreachable : Logoff

   Guest VLAN                 : 100

   Guest VLAN auth-period     : 150 s

   Critical VLAN              : Not configured

   Critical voice VLAN        : Disabled

   Host mode                  : Multiple VLAN

   Max online users           : 256

   Authentication attempts    : successful 2, failed 3

   Current online users       : 1

          MAC address       Auth state

          0001-0000-0001    Unauthenticated

 

 AP name: AP1  Radio ID: 1  SSID: wlan_maca_ssid

   BSSID                      : 1111-1111-1111

 MAC authentication           : Enabled

   Authentication domain      : Not configured

   Max online users           : 256

   Authentication attempts    : successful 1, failed 0

   Current online users       : 2

          MAC address       Auth state

          0001-0000-0002    Authenticated

          0001-0000-0003    Unauthenticated

Table 1 Command output

Field	Description
MAC authentication	Whether MAC authentication is enabled globally. Support for MAC authentication depends on the device model. The MAC authentication configuration does not take effect on some device models.
User name format	User account type: MAC-based or shared. ·     If MAC-based accounts are used, this field displays the format settings for the username. For example, MAC address in lowercase(xx-xx-xx-xx-xx-xx) indicates that the MAC address is in six-section format, and letters are in lower case. ·     If a shared account is used, this field displays Fixed account.
Username	Username for MAC authentication. ·     If MAC-based accounts are used, this field displays mac. The device uses the MAC address of each user as the username and password for MAC authentication. ·     If a shared account is used, this field displays the username of the shared account for MAC authentication users. By default, the username is mac.
Password	Password for MAC authentication. ·     If MAC-based accounts are used or if a shared account is used but no password is configured, this field displays Not configured. ·     If a shared account is used and a password is configured, this field displays a string of asterisks (******).
Offline detect period	Offline detect timer.
Quiet period	Quiet timer.
Server timeout	Server timeout timer.
Authentication domain	MAC authentication domain specified in system view. If no authentication domain is specified in system view, this field displays Not configured, use default domain.
Online MAC-auth wired users	Number of wired online MAC authentication users, including users that have passed MAC authentication and users that are performing MAC authentication.
Silent MAC users	Information about silent MAC addresses.
MAC address	Silent MAC address.
VLAN ID	ID of the VLAN to which the silent MAC address belongs.
From port	Name of the port that marks the MAC address as a silent MAC address.
Port index	Index of the port that marks the MAC address as a silent MAC address.
GigabitEthernet1/0/1 is link-up	Status of the link on GigabitEthernet 1/0/1. In this example, the link is up.
MAC authentication	Whether MAC authentication is enabled on the port.
Carry User-IP	Whether user IP addresses are included in MAC authentication requests.
Authentication domain	MAC authentication domain specified for the port.
Auth-delay timer	Whether MAC authentication delay is enabled on the port.
Auth-delay period	MAC authentication delay timer.
Re-auth server-unreachable	Action taken when no server is reachable for MAC reauthentication: ·     Logoff—Logs off online MAC authentication users. ·     Online—Keeps MAC authenticated users online.
Guest VLAN	MAC authentication guest VLAN configured on the port. If no MAC authentication guest VLAN is configured, this field displays Not configured.
Guest VLAN auth-period	Authentication interval for users in the MAC authentication guest VLAN on the port.
Critical VLAN	MAC authentication critical VLAN configured on the port. If no MAC authentication critical VLAN is configured, this field displays Not configured.
Critical voice VLAN	Whether the MAC authentication critical voice VLAN feature is enabled on the port.
Host mode	·     If multi-VLAN mode is enabled, this field displays Multiple VLAN. ·     If multi-VLAN mode is disabled, this field displays Single VLAN.
Max online users	Maximum number of concurrent online users allowed on the port.
Authentication attempts: successful 1, failed 0	MAC authentication statistics, including the number of successful and unsuccessful authentication attempts.
MAC address	MAC address of the online user.
Auth state	User status: ·     Authenticated—The user has passed MAC authentication. ·     Unauthenticated—The user failed MAC authentication.
AP name	Name of the AP with which users are associated.
Radio ID	ID of the radio with which users are associated.
SSID	SSID with which users are associated.
BSSID	ID of the BSS with which users are associated.

 

display mac-authentication connection

Use display mac-authentication connection to display information about online MAC authentication users.

Syntax

In standalone mode:

display mac-authentication connection [ interface interface-type interface-number | slot slot-number | user-mac mac-addr | user-name user-name ]

In IRF mode:

display mac-authentication connection [ chassis chassis-number slot slot-number | interface  interface-type interface-number | user-mac mac-addr | user-name user-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

context-admin

context-operator

Parameters

interface interface-type interface-number: Specifies a port by its type and number. If you do not specify a port, this command displays information about online MAC authentication users for all ports.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays information about online MAC authentication users for all cards. (In standalone mode.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays information about online MAC authentication users for all cards. (In IRF mode.)

user-mac mac-address: Specifies an online MAC authentication user by its MAC address. The mac-address argument represents the MAC address of the user, in the form of H-H-H. If you do not specify an online MAC authentication user, this command displays online user information for all MAC authentication users.

user-name user-name: Specifies an online MAC authentication user by its username. The user name is a case-sensitive string of 1 to 55 characters, and it can include the domain name. If you do not specify an online MAC authentication user, this command displays online user information for all MAC authentication users.

Usage guidelines

(In standalone mode.) If you do not specify any parameters, this command displays information about online MAC authentication users for all cards.

(In IRF mode.) If you do not specify any parameters, this command displays information about online MAC authentication users for all cards.

Examples

# (In standalone mode.) Display all online MAC authentication user information.

<Sysname> display mac-authentication connection

Total connections: 1

 

Slot ID: 0

User MAC address: 0015-e9a6-7cfe

Access interface: GigabitEthernet1/0/1

Username: ias

Authentication domain: h3c

Initial VLAN: 1

Authorization untagged VLAN: 100

Authorization tagged VLAN: N/A

Authorization ACL number/name: 3001

Authorization user profile: N/A

Termination action: Radius-request

Session timeout period: 2 s

Online from: 2013/03/02  13:14:15

Online duration: 0h 2m 15s

 

User MAC address              : 0015-e9a6-7cfe

AP name                       : ap1

Radio ID                      : 1

SSID                          : wlan_dot1x_ssid

BSSID                         : 0015-e9a6-7cf0

User name                     : ias

Authentication domain         : 1

Initial VLAN                  : 1

Authorization VLAN   : 100

Authorization ACL number      : 3001

Authorization user profile    : N/A

Authorization CAR             :

  Average input rate          : 102400 bps

  Average output rate         : 102400 bps

Authorization URL             : N/A

Termination action            : Radius-request

Session timeout period        : 2 sec

Online from                   : 2014/06/02 13:14:15

Online duration               : 0h 2m 15s

# (In IRF mode.) Display all online MAC authentication user information.

<Sysname> display mac-authentication connection

Total connections: 1

 

Chassis ID: 1

Slot ID: 0

User MAC address: 0015-e9a6-7cfe

Access interface: GigabitEthernet1/0/1

Username: ias

Authentication domain: h3c

Initial VLAN: 1

Authorization untagged VLAN: 100

Authorization tagged VLAN: N/A

Authorization ACL number/name: 3001

Authorization user profile: N/A

Termination action: Radius-request

Session timeout period: 2 s

Online from: 2013/03/02  13:14:15

Online duration: 0h 2m 15s

 

User MAC address              : 0015-e9a6-7cfe

AP name                       : ap1

Radio ID                      : 1

SSID                          : wlan_dot1x_ssid

BSSID                         : 0015-e9a6-7cf0

User name                     : ias

Authentication domain         : 1

Initial VLAN                  : 1

Authorization VLAN   : 100

Authorization ACL number      : 3001

Authorization user profile    : N/A

Authorization CAR             : N/A

Authorization URL             : N/A

Termination action            : Radius-request

Session timeout period        : 2 sec

Online from                   : 2014/06/02 13:14:15

Online duration               : 0h 2m 15s

Table 2 Command output

Field	Description
Total connections	Total number of online MAC authentication users.
User MAC address	MAC address of the user.
Access interface	Interface through which the user accesses the device.
AP name	Name of the AP with which the user is associated.
Radio ID	ID of the radio with which the user is associated.
SSID	SSID with which the user is associated.
BSSID	ID of the BSS with which the user is associated.
Authentication domain	MAC authentication domain to which the user belongs.
IPv4 address	IPv4 address of the user. If no user IPv4 address is available, this field is not displayed.
IPv6 address	IPv6 address of the user. If no user IPv6 address is available, this field is not displayed.
Initial VLAN	VLAN that holds the user before MAC authentication.
Authorization untagged VLAN	Untagged VLAN authorized to the user.
Authorization tagged VLAN	Tagged VLAN authorized to the user.
Authorization VLAN	VLAN authorized to the user.
Authorization ACL number/name	Number or name of the ACL authorized to the user. If no ACL is authorized, this field displays N/A. If ACL authorization fails, this field displays (NOT effective) after the ACL number or name.
Authorization user profile	User profile authorized to the user.
Authorization CAR	Authorization CAR attributes assigned by the server. ·     Average input rate—Average rate of inbound traffic in bps. ·     Average output rate—Average rate of outbound traffic in bps. If no authorization CAR attributes are assigned, this field displays N/A.
Authorization URL	URL authorized to the user.
Termination action	Action attribute assigned by the server to terminate the user session: ·     Default—Logs off the online authenticated user when the session timeout timer expires. ·     Radius-request—Reauthenticates the online user when the session timeout timer expires. If the device performs local authentication, this field displays N/A.
Session timeout period	Session timeout timer assigned by the server. If the device performs local authentication, this field displays N/A.
Online from	Time from which the MAC authentication user came online.
Online duration	Online duration of the MAC authentication user.

 

mac-authentication

Use mac-authentication to enable MAC authentication globally or on a port.

Use undo mac-authentication to disable MAC authentication globally or on a port.

Syntax

mac-authentication

undo mac-authentication

Default

MAC authentication is disabled globally or on any port.

Views

System view

Layer 2 Ethernet interface view

Predefined user roles

network-admin

context-admin

Usage guidelines

To use MAC authentication on a port, you must enable the feature both globally and on the port.

Support for MAC authentication depends on the device model. MAC authentication does not take effect on some device models.

Examples

# Enable MAC authentication globally.

<Sysname> system-view

[Sysname] mac-authentication

# Enable MAC authentication on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication

Related commands

display mac-authentication

mac-authentication access-user log enable

Use mac-authentication access-user log enable to enable MAC authentication user logging.

Use undo mac-authentication access-user log enable to disable MAC authentication user logging.

Syntax

mac-authentication access-user log enable [ failed-login | logoff | successful-login ] *

undo mac-authentication access-user log enable [ failed-login | logoff | successful-login ] *

Default

MAC authentication user logging is disabled.

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

failed-login: Logs MAC authentication user login failures.

logoff: Logs MAC authentication user logoffs.

successful-login: Logs successful MAC authentication user logins.

Usage guidelines

To prevent excessive MAC authentication user log entries, use this feature only if you need to analyze abnormal MAC authentication user logins or logouts.

If you do not specify any parameters, this command enables all types of MAC authentication user logs.

Examples

# Enable logging MAC authentication user login failures.

<Sysname> system-view

[Sysname] mac-authentication access-user log enable failed-login

Related commands

info-center source maca logfile deny (Network Management and Monitoring Command Reference)

mac-authentication domain

Use mac-authentication domain to specify a global or port-specific authentication domain.

Use undo mac-authentication domain to restore the default.

Syntax

mac-authentication domain domain-name

undo mac-authentication domain

Default

The system default authentication domain is used. For more information about the default authentication domain, see the domain default enable command in "AAA commands."

Views

System view

Layer 2 Ethernet interface view

Predefined user roles

network-admin

context-admin

Parameters

domain-name: Specifies the name of an ISP domain, a case-insensitive string of 1 to 255 characters.

Usage guidelines

The global authentication domain applies to all MAC authentication-enabled ports. An authentication domain specified in Layer 2 Ethernet interface view applies only to the port. You can specify different authentication domains on different ports.

A port chooses an authentication domain for MAC authentication users in the following order:

1.     Authentication domain specified on the port.

2.     Global authentication domain specified in system view.

3.     Default authentication domain.

Examples

# Specify ISP domain domain1 as the global MAC authentication domain.

<Sysname> system-view

[Sysname] mac-authentication domain domain1

# Specify ISP domain aabbcc as the MAC authentication domain on GigabitEthernet 1/0/1.

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication domain aabbcc

Related commands

display mac-authentication

domain default enable

mac-authentication re-authenticate server-unreachable keep-online

Use mac-authentication re-authenticate server-unreachable keep-online to enable the keep-online feature on a port.

Use undo mac-authentication re-authenticate server-unreachable to restore the default.

Syntax

mac-authentication re-authenticate server-unreachable keep-online

undo mac-authentication re-authenticate server-unreachable

Default

The keep-online feature is disabled on a port. The device logs off online MAC authentication users if no server is reachable for MAC reauthentication.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

context-admin

Usage guidelines

The keep-online feature keeps authenticated MAC authentication users online when no server is reachable for MAC reauthentication.

Examples

# Enable the keep-online feature for authenticated MAC authentication users on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication re-authenticate server-unreachable keep-online

Related commands

display mac-authentication

mac-authentication timer

Use mac-authentication timer to configure a MAC authentication timer.

Use undo mac-authentication timer to restore the default of a MAC authentication timer.

Syntax

mac-authentication timer { offline-detect offline-detect-value | quiet quiet-value | server-timeout server-timeout-value }

undo mac-authentication timer { offline-detect | quiet | server-timeout }

Default

The following MAC authentication timers apply:

·     The offline detect timer is 300 seconds.

·     The quiet timer is 60 seconds.

·     The server timeout timer is 100 seconds.

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

offline-detect offline-detect-value: Sets the offline detect timer in seconds, in the range of 60 to 2147483647.

quiet quiet-value: Sets the quiet timer in seconds, in the range of 1 to 3600.

server-timeout server-timeout-value: Sets the server timeout timer in seconds, in the range of 100 to 300.

Usage guidelines

MAC authentication uses the following timers:

·     Offline detect timer—Sets the interval that the device waits for traffic from a user before the device determines that the user is idle. If the device has not received traffic from a user before the timer expires, the device logs off that user and requests the accounting server to stop accounting for the user.

·     Quiet timer—Sets the interval that the device must wait before the device can perform MAC authentication for a user that has failed MAC authentication. All packets from the MAC address are dropped during the quiet time. This quiet mechanism prevents repeated authentication from affecting system performance.

·     Server timeout timer—Sets the interval that the device waits for a response from a RADIUS server before the device determines that the RADIUS server is unavailable. If the timer expires during MAC authentication, the user cannot access the network.

Examples

# Set the server timeout timer to 150 seconds.

<Sysname> system-view

[Sysname] mac-authentication timer server-timeout 150

Related commands

display mac-authentication

mac-authentication user-name-format

Use mac-authentication user-name-format to configure the type of user accounts for MAC authentication users.

Use undo mac-authentication user-name-format to restore the default.

Syntax

mac-authentication user-name-format { fixed [ account name ] [ password { cipher | simple } string ] | mac-address [ { with-hyphen [ six-section | three-section ] | without-hyphen } [ lowercase | uppercase ] ] }

undo mac-authentication user-name-format

Default

Each user's MAC address is used as the username and password for MAC authentication. The MAC addresses are in hexadecimal notation without hyphens, and letters are in lower case.

Views

System view

Predefined user roles

network-admin

context-admin

Parameters

fixed: Uses a shared account for all MAC authentication users.

account name: Specifies the username for the shared account. The name is a case-sensitive string of 1 to 55 characters, excluding the at sign (@). If you do not specify a username, the default name mac applies.

password: Specifies the password for the shared user account. If you do not specify a password, the shared user account does not have a password.

cipher: Specifies a password in encrypted form.

simple: Specifies a password in plaintext form. For security purposes, the password specified in plaintext form will be stored in encrypted form.

string: Specifies the password. Its plaintext form is a case-sensitive string of 1 to 63 characters. Its encrypted form is a case-sensitive string of 1 to 117 characters.

mac-address: Uses MAC-based user accounts for MAC authentication users. You can also specify the format of username and password by using the following keywords:

·     with-hyphen: Includes hyphens in the MAC address.

¡     six-section: Hyphenates the MAC address into six groups of two hexadecimal digits, for example, xx-xx-xx-xx-xx-xx or XX-XX-XX-XX-XX-XX.

¡     three-section: Hyphenates the MAC address into three groups of four hexadecimal digits, for example, xxxx-xxxx-xxxx or XXXX-XXXX-XXXX.

If you do not specify the six-section or three-section keyword, the MAC address is in six-section format.

·     without-hyphen: Excludes hyphens from the MAC address, for example, xxxxxxxxxxxx or XXXXXXXXXXXX.

·     lowercase: Specifies letters in lower case.

·     uppercase: Specifies letters in upper case.

Usage guidelines

If you specify the MAC-based user account, the device uses the MAC address of a user as the username and password for MAC authentication of the user. This user account type ensures high authentication security. However, you must create on the authentication server a user account for each user, using the MAC address of the user as both the username and password.

If you specify a shared user account, the device uses the specified username and password for MAC authentication of all users. Because all MAC authentication users use a single account for authentication, you only need to create one account on the authentication server. This user account type is suitable for trusted networks.

Examples

# Configure a shared account for MAC authentication users, and set the username to abc and password to plaintext string of xyz.

<Sysname> system-view

[Sysname] mac-authentication user-name-format fixed account abc password simple xyz

# Use MAC-based user accounts for MAC authentication users. The MAC addresses must be in hexadecimal notation without hyphens, and letters are in upper case.

<Sysname> system-view

[Sysname] mac-authentication user-name-format mac-address without-hyphen uppercase

Related commands

display mac-authentication

port-security mac-move permit

Use port-security mac-move permit to enable MAC move on the device.

Use undo port-security mac-move permit to disable MAC move on the device.

Syntax

port-security mac-move permit

undo port-security mac-move permit

Default

MAC move is disabled on the device.

Views

System view

Predefined user roles

network-admin

context-admin

Usage guidelines

This command takes effect on all MAC authentication users.

MAC move allows MAC authenticated users to move between ports on a device. The user VLAN might change or stay unchanged after the move. If a MAC authenticated user moves to another MAC authentication-enabled port on the device, the authentication session is deleted from the first port. The user is reauthenticated on the new port.

If MAC move is disabled, MAC authentication users authenticated on one port cannot pass authentication after they move to another port.

MAC authenticated users cannot move between ports on a device if the number of online users on the authentication server (local or remote) has reached the upper limit.

Examples

# Enable MAC move.

<Sysname> system-view

[Sysname] port-security mac-move permit

reset mac-authentication access-user

Use reset mac-authentication access-user to log off MAC authentication users.

Syntax

reset mac-authentication access-user [ interface interface-type interface-number | mac mac-address | username username | vlan vlan-id | vsi vsi-name ]

Views

User view

Predefined user roles

network-admin

context-admin

Parameters

interface interface-type interface-number: Specifies a port by its type and number.

mac mac-address: Specifies a MAC authentication user by its MAC address. The mac-address argument is in the format of H-H-H.

username username: Specifies a MAC authentication user by its name. The username argument is a case-sensitive string of 1 to 253 characters.

vlan vlan-id: Specifies a VLAN by its VLAN ID. The value range for the vlan-id argument is 1 to 4094.

vsi vsi-name: Specifies a VSI by its name. The vsi-name argument is a case-sensitive string of 1 to 31 characters.

Usage guidelines

Use this command to log off the specified MAC authentication users and clear information about these users from the device. These users must perform MAC authentication to come online again.

With a VSI specified, this command logs off a MAC authentication user if that user has passed authentication and its authorization VSI is the specified VSI.

With a VLAN specified, this command logs off the following MAC authentication users:

·     Users that have passed MAC authentication and have been assigned the specified VLAN as their authorization VLAN by the server.

·     Users that stay in the specified VLAN after they have passed MAC authentication, because they have not been assigned an authorization VLAN yet.

·     Users that are performing MAC authentication in the specified VLAN.

To identify the VLAN in which a user is staying, use the display mac-address command.

If you do not specify any parameters, the reset mac-authentication access-user command logs off all MAC authentication users on the device.

Examples

# Log off all MAC authentication users on GigabitEthernet 1/0/1.

<Sysname> reset mac-authentication access-user interface gigabitethernet 1/0/1

Related commands

display mac-authentication connection

reset mac-authentication statistics

Use reset mac-authentication statistics to clear MAC authentication statistics.

Syntax

reset mac-authentication statistics [ interface interface-type interface-number ]

Views

User view

Predefined user roles

network-admin

context-admin

Parameters

interface interface-type interface-number: Specifies a port by its type and number. If you do not specify a port, this command clears both global and port-specific MAC authentication statistics.

Usage guidelines

If you do not specify any parameters, this command clears all MAC authentication statistics.

Examples

# Clear MAC authentication statistics on GigabitEthernet 1/0/1.

<Sysname> reset mac-authentication statistics interface gigabitethernet 1/0/1

Related commands

display mac-authentication