User Profile Assignment; Periodic Mac Reauthentication; Configuration Prerequisites; Configuration Task List - HPE Moonshot 45Gc Security Configuration Manual

User profile assignment

You can specify a user profile in the user account for a MAC authentication user to control the user's
access to network resources. After the user passes MAC authentication, the authentication server
assigns the user profile to the user to filter traffic for this user. The authentication server can be the
local access device or a RADIUS server. In either case, you must configure the user profile on the
access device.
To change the user's access permissions, you can use one of the following methods:
•
Modify the user profile configuration on the access device.
•
Specify another user profile for the user on the authentication server.
For more information about user profiles, see "Configuring user profiles."

Periodic MAC reauthentication

Periodic MAC reauthentication tracks the connection status of online users, and updates the
authorization attributes assigned by the RADIUS server. The attributes include the ACL, VLAN, and
user profile-based QoS.
The device reauthenticates an online MAC authentication user periodically only after it receives the
termination action Radius-request from the authentication server for this user. The
Session-Timeout attribute (session timeout period) assigned by the server is the reauthentication
interval. To display the server-assigned Session-Timeout and Termination-Action attributes, use the
display mac-authentication connection command. Support for the server configuration and
assignment of Session-Tmeout and Termination-Action attributes depends on the server model.
When no server is reachable for MAC reauthentication, the device keeps the MAC authentication
users online or logs off the users, depending on the keep-online feature configuration on the device.
For information about the keep-online feature, see

Configuration prerequisites

Before you configure MAC authentication, complete the following tasks:
1. Configure an ISP domain and specify an AAA method. For more information, see "Configuring
AAA."
For local authentication, you must also create local user accounts (including usernames
and passwords), and specify the lan-access service for local users.
For RADIUS authentication, make sure the device and the RADIUS server can reach each
other, and create user accounts on the RADIUS server. If you are using MAC-based
accounts, make sure the username and password for each account are the same as the
MAC address of each MAC authentication user.
2. Make sure the port security feature is disabled. For more information about port security, see
"Configuring port security."

Configuration task list

Tasks at a glance
(Required.)
(Optional.) Specifying a MAC authentication domain
(Optional.) Configuring the user account format
Enabling MAC authentication
"Configuring the keep-online
106
feature."