Mac-Authenticiaon Intrusion-Mode Block-Mac - H3C S3100 Series Command Manual

Description
Use the mac-authentication guest-vlan command to configure a MAC authentication guest VLAN for
the current port. If the client connected to the port fails in the MAC authentication, the port will be added
to the guest VLAN, and thus the users accessing the port can access network resources in the guest
VLAN.
Use the undo mac-authentication guest-vlan command to remove the guest VLAN configuration for
the port.
No guest VLAN is configured for a port by default.
The system will re-authenticate users in the guest VLAN at the interval configured by the
mac-authentication timer guest-vlan-reauth command. If the user of a port passes the
authentication, the port will leave the guest VLAN and return to the initial VLAN configured for it.
The undo vlan command cannot be used to remove the VLAN configured as a Guest VLAN. If you
want to remove this VLAN, you must remove the Guest VLAN configuration for it. Refer to the
VLAN module in this manual for the description on the undo vlan command.
Only one Guest VLAN can be configured for a port, and the VLAN configured as the Guest VLAN
must be an existing VLAN. Otherwise, the Guest VLAN configuration does not take effect. If you
want to change the Guest VLAN for a port, you must remove the current Guest VLAN and then
configure a new Guest VLAN for this port.
802.1x authentication cannot be enabled for a port configured with a MAC authentication Guest
VLAN.
The Guest VLAN function for MAC address authentication does not take effect when port security
is enabled.
Related commands: mac-authentication timer guest-vlan-reauth.
Examples
# Configure VLAN 4 as the Guest VLAN for Ethernet 1/0/1.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] interface Ethernet 1/0/1
[Sysname-Ethernet1/0/1] mac-authentication guest-vlan 4

mac-authenticiaon intrusion-mode block-mac

Syntax
mac-authenticiaon intrusion-mode block-mac enable
undo mac-authenticiaon intrusion-mode block-mac enable
View
Ethernet port view
1-12