216
Prerequisites for MAC authentication
Before you configure MAC authentication, configure an ISP domain and specify an AAA method. For
more information, see "
•
For local authentication, you must also create local user accounts (including usernames and
passwords) and specify the
lan-access
service for local users.
•
For RADIUS authentication, make sure the device and the RADIUS server can reach each
other and create user accounts on the RADIUS server. If you are using MAC-based accounts,
make sure the username and password for each account are the same as the MAC address of
each MAC authentication user.
Enabling MAC authentication
For MAC authentication to take effect on a port, you must enable this feature globally and on the port.
To enable MAC authentication:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable MAC authentication
globally.
mac-authentication
By default, MAC authentication
is disabled globally.
3.
Enter interface view.
interface interface-type
interface-number
N/A
4.
Enable MAC authentication on
the port.
mac-authentication
By default, MAC authentication
is disabled on a port.
Specifying a MAC authentication domain
By default, MAC authentication users are in the system default authentication domain. To implement
different access policies for users, you can use one of the following methods to specify
authentication domains for MAC authentication users:
•
Specify a global authentication domain in system view. This domain setting applies to all ports
enabled with MAC authentication.
•
Specify an authentication domain for an individual port in interface view.
MAC authentication chooses an authentication domain for users on a port in this order: the
port-specific domain, the global domain, and the default domain. For more information about
authentication domains, see "
."
To specify an authentication domain for MAC authentication users:
Step Command Remarks
1.
Enter system view.
system-view
N/A
