R2511-HP MSR Router Series Security Command Reference(V5)

172
Ke
y
word Securit
y
mode Descri
p
tion
mac-authentication
macAddressWithRad
ius
In this mode, a port performs MAC authentication for users
and services multiple users.
mac-else-userlogin-secu
re
macAddressElseUserL
oginSecure
This mode is the combination of the
macAddressWithRadius and userLoginSecure modes, with
MAC authentication having a higher priority.
• For wired users, the port performs MAC authentication
30 seconds after receiving non-802.1X frames.
• For wireless users, the port performs MAC
authentication upon receiving non-802.1X frames.
Upon receiving 802.1X frames, the port performs MAC
authentication, and if the MAC authentication fails, it
performs 802.1X authentication.
mac-else-userlogin-secu
re-ext
macAddressElseUserL
oginSecureExt
Similar to the macAddressElseUserLoginSecure mode
except that a port in this mode supports multiple 802.1X
and MAC authentication users.
psk presharedKey
In this mode, a user must use a pre-configured static key,
also called "the PSK," to negotiate with the device and can
access the port only after the negotiation succeeds.
secure secure
In this mode, MAC address learning is disabled on the port
and you can configure MAC addresses by using the
mac-address static and mac-address dynamic commands.
The port permits only frames sourced from secure MAC
addresses and MAC addresses you manually configured
by using the mac-address static and mac-address dynamic
commands.
userlogin userLogin
In this mode, a port performs 802.1X authentication and
implements port-based access control.
If one 802.1X user passes authentication, all the other
802.1X users of the port can access the network without
authentication.
userlogin-secure userLoginSecure
In this mode, a port performs 802.1X authentication and
implements MAC-based access control. It services only
one user passing 802.1X authentication.
userlogin-secure-ext userLoginSecureExt
Similar to the userLoginSecure mode except that this mode
supports multiple online 802.1X users.
userlogin-secure-ext-or-
psk
userLoginSecureExtO
rPresharedKey
In this mode, a user interacts with the device, choosing to
undergo UserLoginSecure mode or use the PSK to
negotiate with the device.
userlogin-secure-or-mac
macAddressOrUserL
oginSecure
This mode is the combination of the userLoginSecure and
macAddressWithRadius modes.
• For wired users, the port performs MAC authentication
30 seconds after receiving non-802.1X frames and
performs 802.1X authentication upon receiving 802.1X
frames.
• For wireless users, the port performs 802.1X
authentication first. If 802.1X authentication fails, MAC
authentication is performed.