4000 Router Series Security Configuration Guide

Local MAC authentication configuration example

Network requirements

As shown in Figure 26, configure local MAC authentication on port GigabitEthernet 1/1 to control

Internet access, as follows:

• Configure the device to detect whether a user has gone offline every 180 seconds, and if a user fails

authentication, deny the user for 180 seconds.

• Configure all users to belong to the ISP domain aabbcc, and specify local authentication for users

in the domain.

• Use the MAC address of each user as the username and password for authentication, and require

the MAC addresses be hyphenated and in lower case.

Figure 26 Network diagram

Configuration procedure

# Add a network access local user, configure both the username and password as the host's MAC

address 00-e0-fc-12-34-56, and specify the LAN access service for the account.

<Device> system-view

[Device] local-user 00-e0-fc-12-34-56 class network

[Device-luser-network-00-e0-fc-12-34-56] password simple 00-e0-fc-12-34-56

[Device-luser-network-00-e0-fc-12-34-56] service-type lan-access

[Device-luser-network-00-e0-fc-12-34-56] quit

# Configure ISP domain aabbcc to perform local authentication for LAN users.

[Device] domain aabbcc

[Device-isp-aabbcc] authentication lan-access local

[Device-isp-aabbcc] quit

# Enable MAC authentication globally.

[Device] mac-authentication

# Enable MAC authentication on port GigabitEthernet 1/1.

[Device] interface gigabitethernet 1/1

[Device-Gigabitethernet1/1] mac-authentication

[Device-Gigabitethernet1/1] quit

# Specify the MAC authentication domain as the ISP domain aabbcc.

[Device] mac-authentication domain aabbcc

# Configure MAC authentication timers.

[Device] mac-authentication timer offline-detect 180

[Device] mac-authentication timer quiet 180