Including User Ip Addresses In Mac Authentication Requests; About The Feature Of Including User Ip Addresses In Mac Authentication Requests; Restrictions And Guidelines; Procedure - H3C SR8800-F Configuration Manual

Including user IP addresses in MAC
authentication requests
About the feature of including user IP addresses in MAC
authentication requests
This feature enables the device to add user IP addresses to the MAC authentication requests that
are sent to an IMC server.
Upon receiving an authentication request, the IMC server compares the user IP and MAC addresses
in the request with its local IP-MAC mapping of the user. If a match is found, the IMC server verifies
the user valid. If no match is found, the user fails the MAC authentication.
The IMC server selects the IP-MAC combination for a MAC authentication user to match in the
following order:
1. The IP and MAC addresses in the IMC platform user account associated with the MAC
authentication user.
2. The IP and MAC addresses that are included in the authentication request. If the server does
not have an authenticated IP-MAC record for the user, it determines that the IP-MAC
combination of the user is valid. The server will record the IP-MAC combination of the user. If
the user IP address is changed at the next authentication, the user cannot pass authentication.

Restrictions and guidelines

When you configure this feature, follow these guidelines and restrictions:
•
This feature takes effect only on MAC authentication users that use static IP addresses. Users
that obtain IP addresses through DHCP are not affected.
•
Do not configure this feature together with the MAC authentication guest VLAN on a port. If both
features are configured, users in the MAC authentication guest VLAN cannot perform a new
round of authentication.

Procedure

To include user IP addresses in MAC authentication requests:
Step
1. Enter system view.
2. Enter Ethernet interface view.
3. Include user IP addresses in
MAC authentication requests.
Display and maintenance commands for MAC
authentication
Execute display commands in any view and reset commands in user view.
Command
system-view
interface interface-type
interface-number
mac-authentication carry
user-ip
222
Remarks
N/A
N/A
By default, a MAC
authentication request does not
include the user IP address.