Configuring Triple Authentication; Overview; Triple Authentication Mechanism - H3C S5500-EI Series Security Configuration Manual

Configuring triple authentication

Overview

Triple authentication enables a Layer 2 access port to perform portal, MAC, and 802.1X authentication.
A terminal can access the network if it passes one type of authentication.
Triple authentication is suitable for a LAN that comprises terminals that require different authentication
services. For example, the triple authentication-enabled access port in
authentication for the printer, 802.1X authentication for a PC installed with the 802.1X client, and port
authentication for the other PC.
Figure 84 Triple authentication network diagram
For more information about portal authentication, MAC authentication and 802.1X authentication, see
"Configuring portal

Triple authentication mechanism

The three types of authentication are triggered by different packets:
The access port performs MAC authentication for a terminal when it receives an ARP or DHCP
•
broadcast packet from the terminal for the first time. If the terminal passes MAC authentication, the
terminal can access the network. If the MAC authentication fails, the access port performs 802.1X
or portal authentication.
The access port performs 802.1X authentication when it receives an EAP packet from an 802.1X
•
client. If the unicast trigger function of 802.1X is enabled on the access port, any packet from an
802.1X client can trigger an 802.1X authentication.
The access port performs portal authentication when it receives an HTTP packet from a terminal.
•
If a terminal triggers different types of authentication, the authentications are processed at the same time.
The failure of one type of authentication does not affect the others. When a terminal passes one type of
authentication, the other types of authentication being performed are terminated. Then, whether the
other types of authentication can be triggered varies:
authentication," "Configuring MAC authentication," and
198
Figure 84 can perform MAC
"Configuring 802.1X."