Configuring The Macaddresselseuserloginsecure Mode - HP 5500 HI Series Configuration Manual

Configuring the macAddressElseUserLoginSecure mode

Network requirements
As shown in
authenticates the client by a RADIUS server. If the authentication succeeds, the client is authorized to
access the Internet.
Restrict port GigabitEthernet 1/0/1 of the Device:
Allow more than one MAC authenticated user to log on.
•
For 802.1X users, perform MAC authentication first and then, if MAC authentication fails, 802.1X
•
authentication. Allow only one 802.1X user to log on.
• Use MAC-based user accounts for MAC authentication users. The MAC addresses are hyphen
separated and in lower case.
Set the total number of MAC authenticated users and 802.1X authenticated users to 64.
•
Enable NTK to prevent frames from being sent to unknown MAC addresses.
•
Configuration procedure
Configurations on the host and RADIUS servers are not shown.
1. Configure the RADIUS protocol:
Configure the RADIUS authentication/accounting and ISP domain settings the same as in
"Configuring the userLoginWithOUI
2. Configure port security:
# Enable port security.
<Device> system-view
[Device] port-security enable
# Configure the device to use hyphenated, lowercased MAC addresses of users as the usernames
and passwords for MAC authentication.
[Device] mac-authentication user-name-format mac-address with-hyphen lowercase
[Device] interface gigabitethernet 1/0/1
# Specify ISP domain sun for MAC authentication.
[Device] mac-authentication domain sun
[Device] interface gigabitethernet 1/0/1
# Set the 802.1X authentication method to CHAP. (This configuration is optional. By default, the
authentication method is CHAP for 802.1X.)
[Device] dot1x authentication-method chap
# Set port security's limit on the number of MAC addresses to 64 on the port.
[Device-GigabitEthernet1/0/1] port-security max-mac-count 64
# Set the port security mode to macAddressElseUserLoginSecure.
[Device-GigabitEthernet1/0/1] port-security port-mode mac-else-userlogin-secure
# Set the NTK mode of the port to ntkonly.
[Device-GigabitEthernet1/0/1] port-security ntk-mode ntkonly
Verifying the configuration
# Display the port security configuration.
<Device> display port-security interface gigabitethernet 1/0/1
Equipment port-security is enabled
Figure 74, a client is connected to the Device through GigabitEthernet 1/0/1. The Device
mode."
212