78
Silent MAC address information
When a user fails MAC authentication, the device marks the user's MAC address as a silent MAC
address, drops the packet, and starts a quiet timer. The device drops all subsequent packets from
the silent MAC address within the quiet time. The quiet mechanism avoids repeated authentication
during the quiet time.
Username format
MAC authentication supports the following username formats:
•
Individual
MAC
address
—The device uses the MAC address of each user as the username
and password for MAC authentication. This format is suitable for an insecure environment.
•
Shared
username
—You specify one username and password, which is not necessarily a MAC
address, for all MAC authentication users on the device. This format is suitable for a secure
environment.
MAC authentication domain
By default, MAC authentication users are in the system default authentication domain. To implement
different access policies for users, you can use one of the following methods to specify
authentication domains for MAC authentication users:
•
Specify a global authentication domain. This domain setting applies to all ports enabled with
MAC authentication.
•
Specify an authentication domain for an individual port.
MAC authentication chooses an authentication domain for users on a port in the following order: the
port-specific domain, the global domain, and the default domain.
Offline detect timer
This timer sets the interval that the device waits for traffic from a user before the device regards the
user idle. If a user connection has been idle within the interval, the device logs the user out and stops
accounting for the user.
Quiet timer
This timer sets the interval that the device must wait before the device can perform MAC
authentication for a user who has failed MAC authentication. All packets from the MAC address are
dropped during the quiet time.
Server timeout timer
This timer sets the interval that the device waits for a response from a RADIUS server before the
device regards the RADIUS server unavailable. If the timer expires during MAC authentication, the
user cannot access the network.
MAC authentication configuration on a port
For MAC authentication to take effect on a port, you must enable this feature globally and on the port.
Authentication delay
When both 802.1X authentication and MAC authentication are enabled on a port, you can delay
MAC authentication so that 802.1X authentication is preferentially triggered.
If no 802.1X authentication is triggered or 802.1X authentication fails within the delay period, the port
continues to process MAC authentication.
Do not set the port security mode to
mac-else-userlogin-secure
or
mac-else-userlogin-secure-ext
when you use MAC authentication delay. The delay does not take
effect on a port in either of the two modes.
