211
Configuring MAC authentication
About MAC authentication
MAC authentication controls network access by authenticating source MAC addresses on a port.
The feature does not require client software, and users do not have to enter a username and
password for network access. The device initiates a MAC authentication process when it detects an
unknown source MAC address on a MAC authentication-enabled port. If the MAC address passes
authentication, the user can access authorized network resources. If the authentication fails, the
device marks the MAC address as a silent MAC address, drops the packet, and starts a quiet timer.
The device drops all subsequent packets from the MAC address within the quiet time. The quiet
mechanism avoids repeated authentication during a short time.
User account policies
MAC authentication supports the following user account policies:
•
One MAC-based user account for each user. As shown in
, the access device uses
the source MAC addresses in packets as the usernames and passwords of users for MAC
authentication. This policy is suitable for an insecure environment.
•
One shared user account for all users. You specify one username and password, which are not
necessarily a MAC address, for all MAC authentication users on the access device. This policy
is suitable for a secure environment. See
Figure 67 MAC-based user account policy
Figure 68 Shared user account policy
Fixed account
Username
：
abc
Password
：
123
Username/Password
（
abc/123
）
Local user account
abc
User account
RADIUS user account
abc
Device
RADIUS server
Host
MAC: 2-2-2
Host
MAC: 1-1-1
