119
MAC authentication chooses an authentication domain for users on a port in this order: the
port-specific domain, the global domain, and the default domain. For more information about
authentication domains, see "
."
To specify an authentication domain for MAC authentication users:
Step Command Remarks
1.
Enter system view.
system-view
N/A
2.
Specify an authentication
domain for MAC
authentication users.
•
In system view:
mac-authentication domain
domain-name
•
In Layer 2 Ethernet interface
view:
a. interface
interface-type
interface-number
b. mac-authentication
domain
domain-name
By default, the system default
authentication domain is used for
MAC authentication users.
Configuring the user account format
Step Command Remarks
1.
Enter system view.
system-view
N/A
2.
Configure the MAC
authentication user
account format.
•
Use one MAC-based user
account for each user:
mac-authentication
user-name-format mac-address
[ {
with-hyphen
|
without-hyphen
} [
lowercase
|
uppercase
] ]
•
Use one shared user account for
all users:
mac-authentication
user-name-format
fixed
[
account
name
] [
password
{
cipher
|
simple
}
password
]
By default, the device uses the
MAC address of a user as the
username and password for
MAC authentication. The MAC
address is in the hexadecimal
notation without hyphens, and
letters are in lower case.
Setting MAC authentication timers
MAC authentication uses the following timers:
•
Offline detect timer
—Sets the interval that the device waits for traffic from a user before the
device regards the user idle. Whether the device logs the user out and requests to stop
accounting for the user after the timer expires depending on the status of the offline detection
feature.
•
Quiet
timer
—Sets the interval that the device must wait before the device can perform MAC
authentication for a user who has failed MAC authentication. All packets from the MAC address
are dropped during the quiet time. This quiet mechanism prevents repeated authentication from
affecting system performance.
•
Server timeout timer
—Sets the interval that the device waits for a response from a RADIUS
server before the device regards the RADIUS server unavailable. If the timer expires during
MAC authentication, the user cannot access the network.
To set MAC authentication timers:
Summary of Contents for 10500 series
Page 326: ...312 No duration limit for this SA ...