H3C SOHO IE4300, Command Reference Manual

Page: 2138 / 3296

25
Keyword Security mode Description
userlogin-
secure-or-
mac
macAddressOrUser
LoginSecure
This mode is the combination of the userLoginSecure and
macAddressWithRadius modes. In this mode, the port allows
one 802.1X authentication user and multiple MAC authentication
users to log in.
In this mode, the port performs 802.1X authentication first. By
default, if 802.1X authentication fails, MAC authentication is
performed.
However, the port in this mode processes authentication
differently when the following conditions exist:
•
The port is enabled with parallel processing of MAC
authentication and 802.1X authentication.
•
The port is enabled with the 802.1X unicast trigger.
•
The port receives a packet from an unknown MAC address.
Under such conditions, the port sends a unicast
EAP-Request/Identity packet to the MAC address to initiate
802.1X authentication. After that, the port immediately processes
MAC authentication without waiting for the 802.1X authentication
result.
userlogin-
secure-or-
mac-ext
macAddressOrUser
LoginSecureExt
Same as the macAddressOrUserLoginSecure mode, except that
a port in this mode supports multiple 802.1X and MAC
authentication users.
userlogin-
withoui
userLoginWithOUI
Similar to the userLoginSecure mode. In addition, a port in this
mode also permits frames from a user whose MAC address
contains a specific OUI.
In this mode, the port performs OUI check at first. If the OUI
check fails, the port performs 802.1X authentication. The port
permits frames that pass OUI check or 802.1X authentication.
Usage guidelines
To change the security mode for a port security enabled port, you must set the port in noRestrictions
mode first. Do not change port security mode when the port has online users.
IMPORTANT:
If you are configuring the autoLearn mode, first set port security's limit on the number of secure
MAC addresses by using the
port-security max-mac-count
command. You cannot change
the setting when the port is operating in autoLearn mode.
When port security is enabled, you cannot enable 802.1X or MAC authentication, or change the
access control mode or port authorization state. The port security automatically modifies these
settings in different security modes.
As a best practice, do not enable the mac-else-userlogin-secure or
mac-else-userlogin-secure-ext mode on the port where MAC authentication delay is enabled. The
two modes are mutually exclusive with the MAC authentication delay feature. For more information
about MAC authentication delay, see "MAC authentication commands."
Examples
# Enable port security, and set GigabitEthernet 1/0/1 to operate in secure mode.
<Sysname> system-view
[Sysname] port-security enable
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] port-security port-mode secure
# Change the port security mode of GigabitEthernet 1/0/1 to userLogin.