H3C Technologies H3C S6300 Series Switches User Manual

Page 93

# Add a local network access user with the username localuser, and password localpass in

plaintext. (Make sure the username and password are the same as those configured on the
RADIUS servers.)

system-view

[Device] local-user localuser class network

[Device-luser-network-localuser] password simple localpass

# Set the service type to lan-access.

[Device-luser-network-localuser] service-type lan-access

[Device-luser-network-localuser] quit

Configure a RADIUS scheme:
# Create the RADIUS scheme radius1 and enter its view.

[Device] radius scheme radius1

# Specify the IP addresses of the primary authentication and accounting RADIUS servers.

[Device-radius-radius1] primary authentication 10.1.1.1

[Device-radius-radius1] primary accounting 10.1.1.1

# Configure the IP addresses of the secondary authentication and accounting RADIUS servers.

[Device-radius-radius1] secondary authentication 10.1.1.2

[Device-radius-radius1] secondary accounting 10.1.1.2

# Specify the shared key between the access device and the authentication server.

[Device-radius-radius1] key authentication simple name

# Specify the shared key between the access device and the accounting server.

[Device-radius-radius1] key accounting simple money

# Exclude the ISP domain name from the usernames sent to the RADIUS servers.

[Device-radius-radius1] user-name-format without-domain

[Device-radius-radius1] quit

NOTE:

The access device must use the same username format as the RADIUS server. If the RADIUS server
includes the ISP domain name in the username, so must the access device.

Configure the ISP domain:
# Create the ISP domain bbb and enter its view.

[Device] domain bbb

# Apply the RADIUS scheme radius1 to the ISP domain, and specify local authentication as the

secondary authentication method.

[Device-isp-bbb] authentication lan-access radius-scheme radius1 local

[Device-isp-bbb] authorization lan-access radius-scheme radius1 local

[Device-isp-bbb] accounting lan-access radius-scheme radius1 local

[Device-isp-bbb] quit

Configure 802.1X:
# Enable 802.1X on Ten-GigabitEthernet 1/0/1.

[Device] interface ten-gigabitethernet 1/0/1

[Device-Ten-GigabitEthernet1/0/1] dot1x

# Enable MAC-based access control on the port. (Optional. MAC-based access control is the

default setting.)

[Device-Ten-GigabitEthernet1/0/1] dot1x port-method macbased

This manual is related to the following products:

H3C S5820V2 Series Switches H3C S5830 Series Switches H3C S5830V2 Series Switches H3C S3600V2 Series Switches