108
MAC authentication chooses an authentication domain for users on a port in this order: the
port-specific domain, the global domain, and the default domain. For more information about
authentication domains, see "Configuring AAA."
To specify an authentication domain for MAC authentication users:
Step Command Remarks
1.
Enter system view.
system-view
N/A
2.
Specify an authentication
domain for MAC
authentication users.
•
In system view:
mac-authentication domain
domain-name
•
In Layer 2 Ethernet interface
view:
a. interface
interface-type
interface-number
b. mac-authentication
domain
domain-name
By default, the system default
authentication domain is used for
MAC authentication users.
Configuring the user account format
Step Command Remarks
1.
Enter system view.
system-view
N/A
2.
Configure the MAC
authentication user
account format.
•
Use one MAC-based user
account for each user:
mac-authentication
user-name-format mac-address
[ {
with-hyphen
|
without-hyphen
} [
lowercase
|
uppercase
] ]
•
Use one shared user account for
all users:
mac-authentication
user-name-format
fixed
[
account
name
] [
password
{
cipher
|
simple
}
password
]
By default, the device uses the
MAC address of a user as the
username and password for
MAC authentication. The MAC
address is in the hexadecimal
notation without hyphens, and
letters are in lower case.
Setting MAC authentication timers
MAC authentication uses the following timers:
•
Offline detect timer
—Sets the interval that the device waits for traffic from a user before the
device regards the user idle. If a user connection has been idle within the interval, the device
logs the user out and stops accounting for the user.
After you set the offline detect timer, assign the same value to the MAC address aging timer by
using the
mac-address timer
command. This operation prevents a MAC authenticated user
from being offline within the offline detect timer due to MAC address entry expiration.
•
Quiet
timer
—Sets the interval that the device must wait before the device can perform MAC
authentication for a user who has failed MAC authentication. All packets from the MAC address
are dropped during the quiet time. This quiet mechanism prevents repeated authentication from
affecting system performance.
•
Server timeout timer
—Sets the interval that the device waits for a response from a RADIUS
server before the device regards the RADIUS server unavailable. If the timer expires during
MAC authentication, the user cannot access the network.
