H3C SR8800-F, Configuration Manual

Page: 228 / 502

212
Authentication methods
You can perform MAC authentication on the access device (local authentication) or through a
RADIUS server.
For more information about configuring local authentication and RADIUS authentication, see
"
Configuring AAA ."
Local authentication
If MAC-based accounts are used, the access device uses the source MAC address of the packet as
the username and password to search the local account database for a match.
If a shared account is used, the access device uses the shared account username and password to
search the local account database for a match.
RADIUS authentication
If MAC-based accounts are used, the access device sends the source MAC address of the packet as
the username and password to the RADIUS server for authentication.
If a shared account is used, the access device sends the shared account username and password to
the RADIUS server for authentication.
VLAN assignment
Authorization VLAN
The device uses the authorization VLAN to control the access of a MAC authentication user to
authorized network resources.
The device supports the following VLAN authorization methods:
•
Remote VLAN authorization —The authorization VLAN information of a MAC authentication
user is assigned by a remote server. The device can resolve server-assigned VLANs in the form
of VLAN ID or VLAN name.
The port through which the user accesses the device is assigned to the authorization VLAN as
a tagged or untagged member.
•
Local VLAN authorization —The authorization VLAN of a MAC authentication user is
specified in user view or user group view in the form of VLAN ID on the device.
The port through which the user accesses the device is assigned to the VLAN as an untagged
member. Tagged VLAN assignment is not supported.
For more information about local authorization VLAN configuration, see " Configuring AAA ."
Table 9 describes the way the network access device handles authorization VLANs for MAC
authenticated users.