Configuring The User Account Format; Setting Mac Authentication Timers - HPE Moonshot 45Gc Security Configuration Manual

MAC authentication chooses an authentication domain for users on a port in this order: the
port-specific domain, the global domain, and the default domain. For more information about
authentication domains, see "Configuring AAA."
To specify an authentication domain for MAC authentication users:
Step
1. Enter system view.
2. Specify an authentication
domain for MAC
authentication users.

Configuring the user account format

Step
1. Enter system view.
2. Configure the MAC
authentication user
account format.

Setting MAC authentication timers

MAC authentication uses the following timers:
•
Offline detect timer—Sets the interval that the device waits for traffic from a user before the
device regards the user idle. If a user connection has been idle within the interval, the device
logs the user out and stops accounting for the user.
After you set the offline detect timer, assign the same value to the MAC address aging timer by
using the mac-address timer command. This operation prevents a MAC authenticated user
from being offline within the offline detect timer due to MAC address entry expiration.
•
Quiet timer—Sets the interval that the device must wait before the device can perform MAC
authentication for a user who has failed MAC authentication. All packets from the MAC address
are dropped during the quiet time. This quiet mechanism prevents repeated authentication from
affecting system performance.
•
Server timeout timer—Sets the interval that the device waits for a response from a RADIUS
server before the device regards the RADIUS server unavailable. If the timer expires during
MAC authentication, the user cannot access the network.
Command
system-view
•
In system view:
mac-authentication domain
domain-name
•
In Layer 2 Ethernet interface
view:
a. interface interface-type
interface-number
b. mac-authentication
domain domain-name
Command
system-view
•
Use one MAC-based user
account for each user:
mac-authentication
user-name-format mac-address
[ { with-hyphen |
without-hyphen } [ lowercase |
uppercase ] ]
•
Use one shared user account for
all users:
mac-authentication
user-name-format fixed
[ account name ] [ password
{ cipher | simple } password ]
108
Remarks
N/A
By default, the system default
authentication domain is used for
MAC authentication users.
Remarks
N/A
By default, the device uses the
MAC address of a user as the
username and password for
MAC authentication. The MAC
address is in the hexadecimal
notation without hyphens, and
letters are in lower case.