130
Triple authentication configuration
Triple authentication overview
The terminals in a LAN may support different authentication methods. As shown in
, a printer
supports only MAC authentication, a PC installed with the 802.1X client supports 802.1X authentication,
and the other PC carries out portal authentication. To satisfy the different authentication requirements, the
port of the access device which connects to the terminals needs to support all the three types of
authentication and allow a terminal to access the network after the terminal passes one type of
authentication.
Figure 44
Triple authentication network diagram
IP network
802.1X client
Web user
Printer
802.1X authentication
MAC authentication
Portal authentication
AAA server
The triple authentication solution can satisfy the requirements. It is implemented by enabling portal
authentication, MAC authentication, and 802.1X authentication on a Layer-2 access port. A terminal
connected to that port can access the network after passing a type of authentication.
NOTE:
For more information about portal authentication, MAC authentication, and 802.1X authentication, see
the chapters “Portal configuration,” “MAC authentication configuration,” and “802.1X configuration.”
Triple authentication mechanism
The three types of authentication enabled on an access port are triggered differently.
Upon receiving an ARP or DHCP broadcast packet from a terminal for the first time, the access port
performs MAC authentication on the terminal. If the terminal passes MAC authentication, no other
types of authentication will be performed for it. If it fails, 802.1X or portal authentication can be
triggered.
Upon receiving an EAP packet from an 802.1X client or a thirty-party client, the access port performs
only 802.1X authentication on the terminal.
