185
Configuring triple authentication
Overview
Triple authentication enables a Layer 2 access port to perform portal, MAC, and 802.1X authentication.
A terminal can access the network if it passes one type of authentication.
Triple authentication is suitable for a LAN that comprises terminals that require different authentication
services. For example, the triple authentication-enabled access port in
can perform MAC
authentication for the printer, 802.1X authentication for a PC installed with the 802.1X client, and port
authentication for the other PC.
Figure 70
Triple authentication network diagram
For more information about portal authentication, MAC authentication and 802.1X authentication, see
"
Configuring portal authentication
Configuring MAC authentication
and
."
Triple authentication mechanism
The three types of authentication are triggered by different packets:
•
The access port performs MAC authentication for a terminal when it receives an ARP or DHCP
broadcast packet from the terminal for the first time. If the terminal passes MAC authentication, the
terminal can access the network. If the MAC authentication fails, the access port performs 802.1X
or portal authentication.
•
The access port performs 802.1X authentication when it receives an EAP packet from an 802.1X
client. If the unicast trigger function of 802.1X is enabled on the access port, any packet from an
802.1X client can trigger an 802.1X authentication.
•
The access port performs portal authentication when it receives an HTTP packet from a terminal.
If a terminal triggers different types of authentication, the authentications are processed at the same time.
The failure of one type of authentication does not affect the others. When a terminal passes one type of
authentication, the other types of authentication being performed are terminated. Then, whether the
other types of authentication can be triggered varies:
