H3C S5600 Series Operation Manual page 673

Operation Manual – MAC Address Authentication
H3C S5600 Series Ethernet Switches
III. Configuration Procedure
# Enable MAC address authentication on port GigabitEthernet 1/0/2.
<Sysname> system-view
[Sysname] mac-authentication interface GigabitEthernet 1/0/2
# Set the user name in MAC address mode for MAC address authentication, requiring
hyphened lowercase MAC addresses as the usernames and passwords.
[Sysname] mac-authentication authmode usernameasmacaddress usernameformat
with-hyphen lowercase
# Add a local user.
Specify the user name and password.
[Sysname] local-user 00-0d-88-f6-44-c1
[Sysname-luser-00-0d-88-f6-44-c1] password simple 00-0d-88-f6-44-c1
Set the service type to lan-access.
[Sysname-luser-00-0d-88-f6-44-c1] service-type lan-access
[Sysname-luser-00-0d-88-f6-44-c1] quit
# Add an ISP domain named aabbcc.net.
[Sysname] domain aabbcc.net
New Domain added.
# Specify to perform local authentication.
[Sysname-isp-aabbcc.net] scheme local
[Sysname-isp-aabbcc.net] quit
# Specify aabbcc.net as the ISP domain for MAC address authentication
[Sysname] mac-authentication domain aabbcc.net
# Enable MAC address authentication globally (This is usually the last step in
configuring access control related features. Otherwise, a user may be denied of access
to the networks because of incomplete configuaration.)
[Sysname] mac-authentication
After doing so, your MAC address authentication configuration will take effect
immediately. Only users with the MAC address of 00-0d-88-f6-44-c1 are allowed to
access the Internet through port GigabitEthernet 1/0/2.
Chapter 1 MAC Address Authentication
1-9
Configuration