R2511-HP MSR Router Series Security Configuration Guide(V5)

119
• Specify an authentication domain for an individual port in interface view.
MAC authentication chooses an authentication domain for users on a port in the following order: the
port-specific domain, the global domain, and the default domain. For more information about
authentication domains, see "Configuring AAA."
To specify an authentication domain for MAC authentication users:
Ste
p
Command Remarks
1. Enter system view.
system-view N/A
2. Specify an authentication
domain for MAC
authentication users in
system view or interface
view.
• In system view:
mac-authentication domain
domain-name
• In interface view:
a. interface interface-type
interface-number
b. mac-authentication domain
domain-name
By default, the system default
authentication domain is used for
MAC authentication users.
Configuring MAC authentication delay
When both 802.1X authentication and MAC authentication are enabled on a port, you can delay MAC
authentication so that 802.1X authentication is preferentially triggered. If no 802.1X authentication is
triggered or 802.1X authentication fails within the delay period, the port continues to process MAC
authentication.
Do not set the port security mode to mac-else-userlogin-secure or mac-else-userlogin-secure-ext when
you use MAC authentication delay. The delay does not take effect on a port in either of the two modes.
For more information about port security modes, see "Configuring port security."
To configure MAC authentication delay:
Step Command Remarks
1. Enter system view.
system-view N/A
2. Enter Layer 2 Ethernet
interface view.
interface interface-type
interface-number
N/A
3. Enable MAC authentication
delay and set the delay timer.
mac-authentication timer
auth-delay time
By default, MAC authentication
delay is disabled.
Displaying and maintaining MAC authentication
Task Command Remarks
Display MAC authentication
information.
display mac-authentication [ interface
interface-list ] [ | { begin | exclude |
include } regular-expression ]
Available in any view.
Clear MAC authentication
statistics.
reset mac-authentication statistics
[ interface interface-list ]
Available in user view.