Table of Contents
Advertisement
Configuring Authentication and Authorization by MAC Address
301
(For details about MAC address globs, see "MAC Address Globs" on
page 25.)
You can add authorization attributes to authenticated MAC users with
the following command:
set mac-user mac-addr attr attribute-name value
For example, to add the MAC user 00:01:02:03:04:05 to VLAN red:
WX1200# set mac-user 00:01:02:03:04:05 attr vlan-name red
success: change accepted
To change the value of an authorization attribute, reenter the command
with the new value. To clear an authorization attribute from a MAC user
profile in the local database, use the following command:
clear mac-user mac-addr attr attribute-name
For example, the following command clears the VLAN assignment from
MAC user 01:0f:02:03:04:05:
WX1200# clear mac-user 01:0f:03:04:05:06 attr vlan-name
success: change accepted.
(For a complete list of authorization attributes, see Table 32 on
page 314.)
Changing the MAC
When you enable MAC authentication, the client does not supply a
Authorization
regular username or password. The MAC address of the user's device is
Password for RADIUS
extracted from frames received from the device.
To authenticate and authorize MAC users via RADIUS, MSS must supply a
password for MAC users, which is called the outbound authorization
password. By default, MSS sends the MAC user's MAC address as that
user's password too.
To set the authorization password to a specific value for all MAC users,
use the following command:
set radius server server-name author-password password
Before setting the outbound authorization password for a RADIUS server,
you must have set the address for the RADIUS server. For more
information, see "Configuring RADIUS Servers" on page 345.
Advertisement
Table of Contents
