Mac Authentication Overview - 3Com 4210 PWR Configuration Manual

22
MAC Authentication
Overview
Performing MAC
Authentication on a
RADIUS Server
Performing MAC
Authentication Locally
MAC A
UTHENTICATION
C
ONFIGURATION
MAC authentication provides a way for authenticating users based on ports and
MAC addresses, without requiring any client software to be installed on the hosts.
Once detecting a new MAC address, it initiates the authentication process. During
authentication, the user does not need to enter username or password manually.
You can implement MAC authentication locally or on a RADIUS server.When
combined with RADIUS Authentication, this feature is referred to as RADIUS
Authenticated Device Access, or RADA.
After determining the authentication method, users can select one of the
following types of user name as required:
MAC address mode, where the MAC address of a user serves as both the user
■
name and the password.
Fixed mode, where user names and passwords are configured on a switch in
■
advance. In this case, the user name, the password, and the limits on the total
number of user names are the matching criterion for successful authentication.
For details, refer to "AAA Configuration" on page 245 for information about
local user attributes.
When authentications are performed on a RADIUS server, the switch serves as a
RADIUS client and completes MAC authentication in combination of the RADIUS
server.
In MAC address mode, the switch sends the MAC addresses detected to the
■
RADIUS server as both the user names and passwords.
In fixed mode, the switch sends the user name and password previously
■
configured for the user to the RADIUS server for authentication.
A user can access a network upon passing the authentication performed by the
RADIUS server.
When authentications are performed locally, users are authenticated by switches.
In this case,
In MAC address mode, the local user name to be configured is the MAC
■
address of an access user. Hyphens must or must not be included depending
on the format configured with the mac-authentication authmode
usernameasmacaddress usernameformat command; otherwise, the
authentication will fail.
In fixed mode, all users' MAC addresses are automatically mapped to the
■
configured local passwords and usernames.