HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

118
Specifying a MAC authentication domain
By default, MAC authentication users are in the system default authentication domain. To implement
different access policies for users, you can specify authentication domains for MAC authentication
users in the following ways:
• Specify a global authentication domain in system view. This domain setting applies to all ports.
• Specify an authentication domain for an individual port in interface view.
MAC authentication chooses an authentication domain for users on a port in the following order: the
port-specific domain, the global domain, and the default domain. For more information about
authentication domains, see "Configuring AAA."
To specify an authentication domain for MAC authentication users:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Specify an authentication
domain for MAC
authentication users in
system view or interface
view.
• In system view:
mac-authentication domain
domain-name
• In interface view:
a. interface interface-type
interface-number
b. mac-authentication
domain domain-name
By default, the system default
authentication domain is used for
MAC authentication users.
Configuring MAC authentication delay
When both 802.1X authentication and MAC authentication are enabled on a port, you can delay
MAC authentication so that 802.1X authentication is preferentially triggered. If no 802.1X
authentication is triggered or 802.1X authentication fails within the delay period, the port continues to
process MAC authentication.
Do not set the port security mode to mac-else-userlogin-secure or
mac-else-userlogin-secure-ext when you use MAC authentication delay. The delay does not take
effect on a port in either of the two modes. For more information about port security modes, see
"Configuring port security."
To configure MAC authentication delay:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter Layer 2 Ethernet
interface view.
interface
interface-type
interface-number
N/A
3. Enable MAC authentication
delay and set the delay
timer.
mac-authentication timer
auth-delay
time
By default, MAC authentication
delay is disabled.

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English