190
Configuring the macAddressElseUserLoginSecure mode
Network requirements
As shown in
, a client is connected to the Router through GigabitEthernet 1/0/1. The Router
authenticates the client by a RADIUS server. If the authentication succeeds, the client is authorized to
access the Internet.
Restrict port GigabitEthernet 1/0/1
of the Router as follows:
•
Allow more than one MAC authenticated user to log on.
•
For 802.1X users, perform MAC authentication first. Then, if MAC authentication fails, perform
802.1X authentication. Allow only one 802.1X user to log on.
•
Set fixed username and password for MAC authentication. Set the total number of MAC
authenticated users and 802.1X authenticated users to 64.
•
Enable NTK to prevent frames from being sent to unknown MAC addresses.
Configurations on the host and RADIUS servers are omitted.
Configuration procedure
1.
Configure the RADIUS protocol.
The required RADIUS authentication/accounting configurations and ISP domain configurations are the
same as those in "
Configuring the userLoginWithOUI mode
."
2.
Configure port security.
# Enable port security.
<Router> system-view
[Router] port-security enable
# Configure a MAC authentication user, setting the username and password to
aaa
and
123456
,
respectively.
[Router] mac-authentication user-name-format fixed account aaa password simple 123456
# Specify ISP domain
sun
for MAC authentication.
[Router] mac-authentication domain sun
[Router] interface gigabitethernet 1/0/1
# Set the 802.1X authentication method to CHAP. (This configuration is optional. By default, the
authentication method is CHAP for 802.1X.)
[Router] dot1x authentication-method chap
# Set the maximum number of secure MAC addresses allowed on the port to 64.
[Router-GigabitEthernet1/0/1] port-security max-mac-count 64
# Set the port security mode to
macAddressElseUserLoginSecure
.
[Router-GigabitEthernet1/0/1] port-security port-mode mac-else-userlogin-secure
# Set the NTK mode of the port to
ntkonly
.
[Router-GigabitEthernet1/0/1] port-security ntk-mode ntkonly
[Router-GigabitEthernet1/0/1] quit
