111
For example, a MAC authentication-enabled port connects to an IP phone that can send tagged and
untagged frames. The port receives tagged frames in VLAN 2 and untagged frames in VLAN 1. Before
you enable the multi-VLAN mode, the port must re-authenticate the IP phone every time it receives a frame
from a VLAN that is different from the recorded MAC-VLAN entry. After you enable the multi-VLAN mode,
the port can receive tagged and untagged frames from the IP phone without triggering a MAC
re-authentication. The multi-VLAN mode improves the transmission quality of data that is vulnerable to
delay and interference.
To enable MAC authentication multi-VLAN mode:
Ste
Command
Remarks
1. Enter system view.
system-view N/A
2. Enter Layer 2 Ethernet
interface view.
interface interface-type
interface-number
N/A
3. Enable MAC authentication
multi-VLAN mode.
mac-authentication host-mode
multi-vlan
By default, a MAC
authentication-enabled port
forwards packets for an
authenticated user only in the
VLAN where the user's MAC
address was authenticated.
This command is available only in
Release 5206 and later.
Displaying and maintaining MAC authentication
Task Command Remarks
Display MAC authentication
information.
display mac-authentication
[ interface interface-list ] [ | { begin
| exclude | include }
regular-expression ]
Available in any view
Clear MAC authentication
statistics.
reset mac-authentication statistics
[ interface interface-list ]
Available in user view
MAC authentication configuration examples
Local MAC authentication configuration example
Network requirements
In the network in Figure 33, perform local MAC authentication on port GigabitEthernet 1/0/1 to control
Internet access. Make sure that:
• All users belong to domain aabbcc.net.
• Local users use their MAC address as the username and password for MAC authentication. The
MAC addresses are hyphen separated and in lower case.
• The access device detects whether a user has gone offline every 180 seconds. When a user fails
authentication, the device does not authenticate the user within 180 seconds.
To Next Page
Loading...
Need help?
General
