H3C Technologies H3C S3100 Series Switches - Manual (Page 456)

1-1
1
MAC Authentication Configuration
MAC Authentication Overview
MAC authentication provides a way for authenticating users based on ports and MAC addresses,
without requiring any client software to be installed on the hosts. Once detecting a new MAC address, it
initiates the authentication process. During authentication, the user does not need to enter username or
password manually.
For S3100 Series Ethernet switches, MAC authentication can be implemented locally or on a RADIUS
server.
After determining the authentication method, users can select one of the following types of user name
as required:
z MAC address mode, where the MAC address of a user serves as both the user name and the
password.
z Fixed mode, where user names and passwords are configured on a switch in advance. In this case,
the user name, the password, and the limits on the total number of user names are the matching
criterion for successful authentication. For details, refer to AAA of this manual for information about
local user attributes.
Performing MAC Authentication on a RADIUS Server
When authentications are performed on a RADIUS server, the switch serves as a RADIUS client and
completes MAC authentication in combination of the RADIUS server.
z In MAC address mode, the switch sends the MAC addresses detected to the RADIUS server as
both the user names and passwords.
z In fixed mode, the switch sends the user name and password previously configured for the user to
the RADIUS server for authentication.
The RADIUS authentication process is the same as that of the 802.1x PAP authentication method. For
details, refer to 802.1x and System-Guard Operation.
A user can access a network upon passing the authentication performed by the RADIUS server.
Performing MAC Authentication Locally
When authentications are performed locally, users are authenticated by switches. In this case,
z In MAC address mode, the local user name to be configured is the MAC address of an access user.
Hyphens must or must not be included depending on the format configured with the
mac-authentication authmode usernameasmacaddress usernameformat command;
otherwise, the authentication will fail.
z In fixed mode, all users’ MAC addresses are automatically mapped to the configured local
passwords and usernames.
z The service type of a local user needs to be configured as lan-access.