H3C HSW-2024G User manual

Operation Manual – Centralized MAC Address Authentication
H3C S3100-52P Ethernet Switch Table of Contents
i
Table of Contents
Chapter 1 Centralized MAC Address Authentication Configuration........................................ 1-1
1.1 Centralized MAC Address Authentication Overview .........................................................1-1
1.2 Centralized MAC Address Authentication Configuration...................................................1-2
1.2.1 Enabling Centralized MAC Address Authentication Globally..................................1-2
1.2.2 Enabling Centralized MAC Address Authentication for a Port................................1-2
1.2.3 Configuring Centralized MAC Address Authentication Mode.................................1-3
1.2.4 Configuring the ISP Domain for MAC Address Authentication Users..................... 1-4
1.2.5 Configuring the Timers Used in Centralized MAC Address Authentication............1-4
1.3 Displaying and Debugging Centralized MAC Address Authentication..............................1-5
1.4 Centralized MAC Address Authentication Configuration Example....................................1-6

Operation Manual – Centralized MAC Address Authentication
H3C S3100-52P Ethernet Switch Chapter 1 Centralized MAC Address Authentication Configuration
1-1
Chapter 1 Centralized MAC Address
Authentication Configuration
1.1 Centralized MAC Address Authentication Overview
Centralized MAC address authentication is port- and MAC address-based
authentication used to control user permissions to access a network. Centralized MAC
address authentication can be performed without client-side software. With this type of
authentication employed, a switch authenticates a user upon detecting the MAC
address of the user for the first time.
Centralized MAC address authentication can be implemented in the following two
modes:
zMAC address mode, where user MAC serves as both the user name and the
password.
zFixed mode, where user names and passwords are configured on a switch in
advance. In this case, every user corresponds to a specific user name and
password configured on the switch.
As for S3100-52P Ethernet Switch, authentication can be performed locally or on a
RADIUS server.
1) When a RADIUS server is used for authentication, the switch serves as a RADIUS
client. Authentication is carried out through the cooperation of switches and the
RADIUS server.
zIn MAC address mode, a switch sends user MAC addresses detected to the
RADIUS server as both user names and passwords. The rest handling procedures
are the same as that of the common RADIUS authentication.
zIn fixed mode, a switch sends the user name and password previously configured
for the user to be authenticated to the RADIUS server and replaces the
calling-station-id field of the RADIUS packet with the MAC address of the user.
The rest handling procedures are the same as that of the common RADIUS
authentication.
zA user can access a network upon passing the authentication performed by the
DADIUS server.
2) When authentications are performed locally, users are authenticated by switches.
In this case,
zFor MAC address mode, you can specify the format to enter the MAC addresses
used as both user name and password by executing corresponding commands.
That is, to specify whether or not MAC addresses are provided in the hyphened

Operation Manual – Centralized MAC Address Authentication
H3C S3100-52P Ethernet Switch Chapter 1 Centralized MAC Address Authentication Configuration
1-2
form. The input format should be the same as the configured format, or else, the
authentication will fail.
zFor fixed mode, configure the local user names and passwords as those for fixed
mode.
zThe service type of a local user needs to be configured as lan-access.
1.2 Centralized MAC Address Authentication Configuration
The following are centralized MAC address authentication configuration tasks:
zEnabling Centralized MAC Address Authentication Globally
zEnabling Centralized MAC Address Authentication for a Port
zConfiguring Centralized MAC Address Authentication Mode
zConfiguring the ISP Domain for MAC Address Authentication Users
zConfiguring the Timers Used in Centralized MAC Address Authentication
Caution:
The configuration of the maximum number of learned MAC addresses (refer to the
mac-address max-mac-count command) is unavailable for the ports with centralized
MAC address authentication enabled. Similarly, the centralized MAC address
authentication is unavailable for the ports with the maximum number of learned MAC
addresses configured.
1.2.1 Enabling Centralized MAC Address Authentication Globally
Table 1-1 Enable centralized MAC address authentication
Operation Command Description
Enter system view system-view —
Enable centralized MAC
address authentication
globally mac-authentication
Required
By default, centralized MAC
address authentication is
globally disabled.
1.2.2 Enabling Centralized MAC Address Authentication for a Port
You can enable centralized MAC address authentication for a port in system view or in
Ethernet port view.

Operation Manual – Centralized MAC Address Authentication
H3C S3100-52P Ethernet Switch Chapter 1 Centralized MAC Address Authentication Configuration
1-3
Table 1-2 Enable centralized MAC address authentication for a port in system view
Operation Command Description
Enter system view system-view —
Enable centralized MAC
address authentication for
specified ports
mac-authentication
interface interface-list
Required
By default, centralized
MAC address
authentication is disabled
on a port.
Table 1-3 Enable centralized MAC address authentication for a port in Ethernet port
view
Operation Command Description
Enter system view system-view —
Enter Ethernet port view interface interface-type
interface-number —
Enable centralized MAC
address authentication for
the current port mac-authentication
Required
By default, centralized
MAC address
authentication is disabled
on a port.
Centralized MAC address authentication for a port can be configured but does not take
effect before global centralized MAC address authentication is enabled. After global
centralized MAC address authentication is enabled, ports enabled with the centralized
MAC address authentication will perform the authentication immediately.
1.2.3 Configuring Centralized MAC Address Authentication Mode
Table 1-4 Configure centralized MAC address authentication mode
Operation Command Description
Enter system view system-view —
Configure centralized
MAC address
authentication mode as
MAC address mode
mac-authentication
authmode
usernameasmacaddres
s [usernameformat
{with-hyphen |
without-hyphen } ]
Optional
By default, the MAC
address mode is adopted.
Configure centralized
MAC address
authentication mode as
fixed mode
mac-authentication
authmode
usernamefixed Optional

Operation Manual – Centralized MAC Address Authentication
H3C S3100-52P Ethernet Switch Chapter 1 Centralized MAC Address Authentication Configuration
1-4
Operation Command Description
Set a user name for fixed
mode
mac-authentication
authusername
username
Required for fixed mode
By default, the user name
is mac and no password
is needed.
Set the password for fixed
mode mac-authentication
authpassword password Optional
1.2.4 Configuring the ISP Domain for MAC Address Authentication Users
Table 1-5 lists the operations to configure the ISP domain for centralized MAC address
authentication users.
Table 1-5 Configure the ISP domain for MAC address authentication users
Operation Command Description
Enter system view system-view —
Configure the ISP domain
for MAC address
authentication users
mac-authentication
domain isp-name
Required
By default, the “default
domain” is used as the
ISP domain.
1.2.5 Configuring the Timers Used in Centralized MAC Address
Authentication
The following timers are used in centralized MAC address authentication:
zOffline detect timer, which sets the time interval for a switch to test whether a user
goes offline. Upon detecting a user is offline, a switch notifies the RADIUS server
of the user to trigger the RADIUS server to stop the accounting on the user.
zQuiet timer, which sets the quiet period for a switch. After a user fails to pass the
authentication performed by a switch, the switch quiets for a specific period (the
quiet period) before it authenticates users again.
zServer timeout timer. During authentication, the switch prohibits the user from
accessing the network through the corresponding port if the connection between
the switch and RADIUS server times out. In this case, the user can have it
authenticated through another port of the switch.
Table 1-6 lists the operations to configure the timers used in centralized MAC address
authentication.

Operation Manual – Centralized MAC Address Authentication
H3C S3100-52P Ethernet Switch Chapter 1 Centralized MAC Address Authentication Configuration
1-5
Table 1-6 Configure the timers used in centralized MAC address authentication
Operation Command Description
Enter system view system-view —
Configure a timer
used in centralized
MAC address
authentication
mac-authentication
timer {offline-detect
offline-detect-value |
quiet quiet-value |
server-timeout
server-timeout-value }
Optional
The default settings of the timers
used in centralized MAC address
authentication are as follows:
zOffline detect timer: 300
seconds
zQuiet timer: 60 seconds
zServer timeout timer: 100
seconds
1.3 Displaying and Debugging Centralized MAC Address
Authentication
After the above configuration, you can execute the display command in any view to
display system running of centralized MAC address authentication configuration, and
to verify the effect of the configuration. You can execute the reset command in user
view to clear the statistics of centralized MAC address authentication.
Table 1-7 Display and debug centralized MAC address authentication
Operation Command Description
Display global or port
information about
centralized MAC address
authentication
display
mac-authentication
[ interface interface-list ]
This command can be
executed in any view.
Clear the statistics of
global or port centralized
MAC address
authentication
reset mac-authentication
statistics [ interface
interface-type
interface-number ]
This command is
executed in user view

Operation Manual – Centralized MAC Address Authentication
H3C S3100-52P Ethernet Switch Chapter 1 Centralized MAC Address Authentication Configuration
1-6
1.4 Centralized MAC Address Authentication Configuration
Example
Note:
Centralized MAC address authentication configuration is similar to that of 802.1x. In
this example, the differences between the two lie in:
zCentralized MAC address authentication needs to be enabled both globally and for
a port.
zIn MAC address mode, MAC address of locally authenticated user is used as both
user name and password.
zIn MAC address mode, MAC address of user authenticated by RADIUS server need
to be configured as both user name and password on the RADIUS server.
The following section describes how to enable centralized MAC address authentication
globally and for a port, andhow to configure a local user. For other related configuration,
refer to the configuration examples in “802.1x” Configuration.
# Enable centralized MAC address authentication for Ethernet 1/0/2 port.
<H3C> system-view
[H3C] mac-authentication interface Ethernet 1/0/2
# Configure centralized MAC address authentication mode as MAC address mode, and
use hyphened MAC addresses as the user names and passwords for authentication.
[H3C] mac-authentication authmode usernameasmacaddress userformat
with-hyphen
# Add a local user.
zConfigure the user name and password.
[H3C] local-user 00-e0-fc-01-01-01
[H3C-luser-00-e0-fc-01-01-01] password simple 00-e0-fc-01-01-01
zSet service type of the local user to lan-access.
[H3C-luser-00-e0-fc-01-01-01] service-type lan-access
# Enable centralized MAC address authentication globally.
[H3C-luser-00-e0-fc-01-01-01] quit
[H3C] mac-authentication
# Configure the domain name for centralized MAC address authentication users as
aabbcc163.net.
[H3C] mac-authentication domain aabbcc163.net
For domain-related configuration, refer to the “802.1x” Configuration Example part of
this manual.