Configuring The Macaddresselseuserloginsecure Mode - HP 10500 Series Configuration Manual

Configuring the macAddressElseUserLoginSecure mode

Network requirements
As shown in
authenticates the client by a RADIUS server. If the authentication succeeds, the client is authorized to
access the Internet.
Restrict port GigabitEthernet 1/0/1 of the device as follows:
Allow more than one MAC authenticated user to log on.
•
For 802.1X users, perform MAC authentication first. Then, if MAC authentication fails, perform
•
802.1X authentication. Allow only one 802.1X user to log on.
• Set fixed username and password for MAC authentication.
Set the total number of MAC authenticated users and 802.1X authenticated users to 64.
•
Enable NTK to prevent frames from being sent to unknown MAC addresses.
•
Configuration procedure
Configuration procedures for the host and RADIUS servers are not shown.
Configuration on the device:
1. Configure the RADIUS protocol.
Configure the RADIUS authentication/accounting and ISP domain settings the same as in
"Configuring the userLoginWithOUI
2. Configure port security:
# Enable port security.
<Device> system-view
[Device] port-security enable
# Configure a MAC authentication user, setting the username and password to aaa and 123456.
[Device] mac-authentication user-name-format fixed account aaa password simple 123456
[Device] interface gigabitethernet 1/0/1
# Specify ISP domain sun for MAC authentication.
[Device] mac-authentication domain sun
[Device] interface gigabitethernet 1/0/1
# Set the 802.1X authentication method to CHAP. (This configuration is optional. By default, the
authentication method is CHAP for 802.1X.)
[Device] dot1x authentication-method chap
# Set port security's limit on the number of MAC addresses to 64 on the port.
[Device-GigabitEthernet1/0/1] port-security max-mac-count 64
# Set the port security mode to macAddressElseUserLoginSecure.
[Device-GigabitEthernet1/0/1] port-security port-mode mac-else-userlogin-secure
# Set the NTK mode of the port to ntkonly.
[Device-GigabitEthernet1/0/1] port-security ntk-mode ntkonly
Verifying the configuration
# Display the port security configuration.
<Device> display port-security interface gigabitethernet 1/0/1
Equipment port-security is enabled
Figure 74, a client is connected to the device through GigabitEthernet 1/0/1. The device
mode."
183