Operation Manual - Security
Quidway S3000-EI Series Ethernet Switches
Chapter 2 AAA and RADIUS Protocol
Configuration
Huawei Technologies Proprietary
2-8
Operation
Command
Set a service type for the
specified user
service-type
{
ftp
[
ftp-directory
directory
] |
lan-access
|
{
ssh
|
telnet
}* [
level level
] }
Cancel the service type of
the specified user
undo service-type
{
ftp
[
ftp-directory
] |
lan-access
|
{
ssh
|
telnet
}* [
level
] }
Configure the attributes of
lan-access users
attribute
{
ip ip-address
|
mac mac-address
|
idle-cut
second
|
access-limit max-user-number
|
vlan vlanid
|
location
{
nas-ip ip-address port
portnum
|
port portnum
}*
Remove the attributes
defined for the lan-access
users
undo attribute
{
ip
|
mac
|
idle-cut
|
access-limit
|
vlan
|
location
}*
2.2.7 Disconnecting a User by Force
Sometimes it is necessary to disconnect a user or a category of users by force. The
system provides the following command to serve for this purpose.
Perform the following configurations in system view.
Table 2-8
Disconnecting a user by force
Operation
Command
Disconnect a
user by force
cut connection
{
all
|
access-type dot1x
}
|
domain
domain-name
|
interface portnum
|
ip ip-address
|
mac
mac-address
|
radius-scheme radius-scheme-name
|
vlan
vlanid
|
ucibindex ucib-index
|
user-name user-name
}
By default, no online user will be disconnected by force.
2.2.8 Configuring Dynamic VLAN with RADIUS Server
Based on the delivery attribute value of the RADIUS server, the switch adds the ports of
the users who have passed the authentication to different VLANs, for purpose of
controlling the network resources that the users can access. In the practical
applications, the ports are set in port-based mode in order to work together with Guest
VLAN. When the port is in MAC address-based mode, each port can only connect a
single user.
Currently the ethernet switches support RADIUS server delivers the integer type and
string type VLAN ID.
z
Integer VLAN ID: The switch adds the port into the VLAN based on the integer ID
delivered from the server. If the VLAN does not exist, it first creates a VLAN and
then adds the port into the new VLAN.
