userLoginWithOUI configuration example

As shown in Figure 76, a client is connected to the device through GigabitEthernet 1/0/1. The device authenticates the client with a RADIUS server in ISP domain sun. If the authentication succeeds, the client is authorized to access the Internet.

• The RADIUS server at 192.168.1.2 acts as the primary authentication server and the secondary accounting server. The RADIUS server at 192.168.1.3 acts as the secondary authentication server and the primary accounting server. The shared key for authentication is name, and the shared key for accounting is money.

• All users use the authentication, authorization, and accounting methods of ISP domain sun.

• The RADIUS server response timeout time is 5 seconds. The maximum number of RADIUS packet retransmission attempts is 5. The device sends real-time accounting packets to the RADIUS server at 15-minute intervals, and sends usernames without domain names to the RADIUS server.

Configure GigabitEthernet 1/0/1 to allow only one 802.1X user and a user who uses one of the specified OUI values to be authenticated.

The following configuration steps cover some AAA/RADIUS configuration commands. For more information about the commands, see Security Command Reference.

Make sure the host and the RADIUS server can reach each other.

1. Configure AAA:

   # Configure a RADIUS scheme named radsun.

   <Device> system-view
   [Device] radius scheme radsun
   [Device-radius-radsun] primary authentication 192.168.1.2
   [Device-radius-radsun] primary accounting 192.168.1.3
   [Device-radius-radsun] secondary authentication 192.168.1.3
   [Device-radius-radsun] secondary accounting 192.168.1.2
   [Device-radius-radsun] key authentication simple name
   [Device-radius-radsun] key accounting simple money
   [Device-radius-radsun] timer response-timeout 5
   [Device-radius-radsun] retry 5
   [Device-radius-radsun] timer realtime-accounting 15
   [Device-radius-radsun] user-name-format without-domain
   [Device-radius-radsun] quit
   

   # Configure ISP domain sun.

   [Device] domain sun
   [Device-isp-sun] authentication lan-access radius-scheme radsun
   [Device-isp-sun] authorization lan-access radius-scheme radsun
   [Device-isp-sun] accounting lan-access radius-scheme radsun
   [Device-isp-sun] quit
   

2. Configure 802.1X:

   # Set the 802.1X authentication method to CHAP. By default, the authentication method for 802.1X is CHAP.

   [Device] dot1x authentication-method chap
   

   # Specify ISP domain sun as the mandatory authentication domain for 802.1X users on GigabitEthernet 1/0/1.

   [Device] interface gigabitethernet 1/0/1
   [Device-GigabitEthernet1/0/1] dot1x mandatory-domain sun
   [Device-GigabitEthernet1/0/1] quit
   

3. Configure port security:

   # Enable port security.

   [Device] port-security enable
   

   # Add five OUI values. (You can add up to 16 OUI values. The port permits only one user matching one of the OUIs to pass authentication.)

   [Device] port-security oui index 1 mac-address 1234-0100-1111
   [Device] port-security oui index 2 mac-address 1234-0200-1111
   [Device] port-security oui index 3 mac-address 1234-0300-1111
   [Device] port-security oui index 4 mac-address 1234-0400-1111
   [Device] port-security oui index 5 mac-address 1234-0500-1111
   

   # Set the port security mode to userLoginWithOUI.

   [Device] interface gigabitethernet 1/0/1
   [Device-GigabitEthernet1/0/1] port-security port-mode userlogin-withoui
   [Device-GigabitEthernet1/0/1] quit
   

# Verify that GigabitEthernet 1/0/1 allows only one 802.1X user to be authenticated.

[Device] display port-security interface gigabitethernet 1/0/1
Global port security parameters:
   Port security          : Enabled
   AutoLearn aging time   : 30 min
   Disableport timeout    : 30 s
   MAC move               : Denied
   Authorization fail     : Online
   NAS-ID profile         : Not configured
   Dot1x-failure trap     : Disabled
   Dot1x-logon trap       : Disabled
   Dot1x-logoff trap      : Disabled
   Intrusion trap         : Disabled
   Address-learned trap   : Disabled
   Mac-auth-failure trap  : Disabled
   Mac-auth-logon trap    : Disabled
   Mac-auth-logoff trap   : Disabled
   OUI value list         :
       Index :  1       Value : 123401
       Index :  2       Value : 123402
       Index :  3       Value : 123403
       Index :  4       Value : 123404
       Index :  5       Value : 123405

 GigabitEthernet1/0/1 is link-up
   Port mode                      : userLoginWithOUI
   NeedToKnow mode                : Disabled
   Intrusion protection mode      : NoAction
Security MAC address attribute 
       Learning mode              : Sticky
       Aging type                 : Periodical
   Max secure MAC addresses       : Not configured
   Current secure MAC addresses   : 1
   Authorization                  :Permitted
   NAS-ID profile                 : Not configured

# Display information about the online 802.1X user to verify 802.1X configuration.

[Device] display dot1x

# Verify that the port also allows one user whose MAC address has an OUI among the specified OUIs to pass authentication.

[Device] display mac-address interface gigabitethernet 1/0/1
MAC Address     VLAN ID   State          Port/NickName            Aging
1234-0300-0011  1         Learned        GE1/0/1                  Y