R3303-HP HSR6800 Routers Security Configuration Guide

117
[Router-radius-2000] quit
# Apply the RADIUS scheme to ISP domain 2000 for authentication, authorization, and
accounting.
[Router] domain 2000
[Router-isp-2000] authentication default radius-scheme 2000
[Router-isp-2000] authorization default radius-scheme 2000
[Router-isp-2000] accounting default radius-scheme 2000
[Router-isp-2000] quit
# Enable MAC authentication globally.
[Router] mac-authentication
# Enable MAC authentication on port GigabitEthernet 3/0/1.
[Router] mac-authentication interface gigabitethernet 3/0/1
# Specify the ISP domain for MAC authentication.
[Router] mac-authentication domain 2000
# Set the MAC authentication timers.
[Router] mac-authentication timer offline-detect 180
[Router] mac-authentication timer quiet 180
# Specify username aaa and password 123456 in plain text for the account shared by MAC
authentication users.
[Router] mac-authentication user-name-format fixed account aaa password simple 123456
Verifying the configuration
# Display MAC authentication settings and statistics.
<Router> display mac-authentication
MAC address authentication is enabled.
User name format is fixed account
Fixed username:aaa
Fixed password:******
Offline detect period is 180s
Quiet period is 180s.
Server response timeout value is 100s
The max allowed user number is 2048 per slot
Current user number amounts to 1
Current domain is 2000
Silent Mac User info:
MAC ADDR From Port Port Index
Gigabitethernet3/0/1 is link-up
MAC address authentication is enabled
Authenticate success: 1, failed: 0
Max number of on-line users is 1024
Current online user number is 1
MAC ADDR Authenticate state Auth Index
00e0-fc12-3456 MAC_AUTHENTICATOR_SUCCESS 52
# After a user passes MAC authentication, use the display connection command to display online user
information.
<Router> display connection
Slot: 3