MAC authentication commands -- display mac-authentication

Use display mac-authentication to display MAC authentication settings and statistics.

Syntax

display mac-authentication [ ap ap-name [ radio radio-id ] | interface interface-type interface-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

ap ap-name: Specifies an AP by its name, a case-insensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-).

radio radio-id: Specifies a radio by its ID. The value range for the radio-id argument varies by device model. If you do not specify a radio, this command displays MAC authentication information for all radios on the specified AP.

interface interface-type interface-number: Specifies a port by its type and number. If the specified port is not enabled with MAC authentication, this command displays only global MAC authentication information.

Usage guidelines

If you do not specify any parameters, this command displays all MAC authentication information including the global settings, port-specific settings, MAC authentication statistics, and online user statistics.

Examples

# Display all MAC authentication settings and statistics.

<Sysname> display mac-authentication

Global MAC authentication parameters:

MAC authentication : Enabled

Username format : MAC address in lowercase(xxxxxxxxxxxx)

Username : mac

Password : Not configured

Offline detect period : 300 s

Quiet period : 60 s

Server timeout : 100 s

Reauth period : 3600 s

Authentication domain : Not configured, use default domain

Online MAC-auth wired users : 1

Online MAC-auth wireless users : 2

Silent MAC users:

MAC address VLAN ID From port Port index

0001-0000-0001 100 GE1/0/2 21

GigabitEthernet1/0/1 is link-up

MAC authentication : Enabled

Carry User-IP : Disabled

Authentication domain : Not configured

Auth-delay timer : Enabled

Auth-delay period : 60 s

Periodic reauth : Enabled

Reauth period : 120 s

Re-auth server-unreachable : Logoff

Guest VLAN : 100

Guest VLAN auth-period : 150 s

Critical VLAN : Not configured

Critical voice VLAN : Disabled

Host mode : Multiple VLAN

Offline detection : Enabled

Authentication order : Parallel

Guest VSI : Not configured

Guest VSI auth-period : 30 s

Critical VSI : Not configured

Auto-tag feature : Disabled

VLAN tag configuration ignoring : Disabled

Max online users : 4294967295

Authentication attempts : successful 2, failed 3

Current online users : 1

MAC address Auth state

0001-0000-0000 Authenticated

0001-0000-0001 Unauthenticated

AP name: AP1 Radio ID: 1 SSID: wlan_maca_ssid

BSSID : 1111-1111-1111

MAC authentication : Enabled

Authentication domain : Not configured

Max online users : 256

Authentication attempts : successful 1, failed 0

Current online users : 2

MAC address Auth state

0001-0000-0002 Authenticated

0001-0000-0003 Unauthenticated

Table 1 Command output

Field | Description
MAC authentication | Whether MAC authentication is enabled globally. Support for MAC authentication depends on the device model. The MAC authentication configuration does not take effect on some device models.
Username format | User account type: MAC-based or shared. · If MAC-based accounts are used, this field displays the format settings for the username. For example, MAC address in lowercase(xxxxxxxxxxxx) indicates that the MAC address is in the hexadecimal notation without hyphens, and letters are in lower case. · If a shared account is used, this field displays Fixed account.
Username | Username for MAC authentication. · If MAC-based accounts are used, this field displays mac. The device uses the MAC address of each user as the username and password for MAC authentication. · If a shared account is used, this field displays the username of the shared account for MAC authentication users. By default, the username is mac.
Password | Password for MAC authentication. · If MAC-based accounts are used or if a shared account is used but no password is configured, this field displays Not configured. · If a shared account is used and a password is configured, this field displays a string of asterisks (******).
Offline detect period | Offline detect timer.
Quiet period | Quiet timer.
Server timeout | Server timeout timer.
Reauth period | Periodic MAC reauthentication timer in seconds.
Authentication domain | MAC authentication domain specified in system view. If no authentication domain is specified in system view, this field displays Not configured, use default domain.
Online MAC-auth wired users | Number of wired online MAC authentication users, including users that have passed MAC authentication and users that are performing MAC authentication.
Online MAC-auth wireless users | Number of wireless online MAC authentication users, including users that have passed MAC authentication and users that are performing MAC authentication.
Silent MAC users | Information about silent MAC addresses, including MAC addresses that have failed MAC authentication and MAC addresses that have been assigned the blackhole MAC attribute from the RADIUS server.
MAC address | Silent MAC address.
VLAN ID | ID of the VLAN to which the silent MAC address belongs.
From port | Name of the port that marks the MAC address as a silent MAC address.
Port index | Index of the port that marks the MAC address as a silent MAC address.
GigabitEthernet1/0/1 is link-up | Status of the link on GigabitEthernet 1/0/1. In this example, the link is up.
MAC authentication | Whether MAC authentication is enabled on the port.
Carry User-IP | ‌ Whether user IP addresses are included in MAC authentication requests.
Authentication domain | MAC authentication domain specified for the port.
Auth-delay timer | Whether MAC authentication delay is enabled on the port.
Auth-delay period | MAC authentication delay timer.
Periodic reauth | Whether periodic MAC reauthentication is enabled on the port.
Reauth period | Periodic MAC reauthentication timer on the port.
Re-auth server-unreachable | Action taken when no server is reachable for MAC reauthentication: · Logoff—Logs off online MAC authentication users. · Online—Keeps MAC authenticated users online.
Guest VLAN | MAC authentication guest VLAN configured on the port. If no MAC authentication guest VLAN is configured, this field displays Not configured.
Guest VLAN auth-period | Authentication interval for users in the MAC authentication guest VLAN on the port.
Critical VLAN | MAC authentication critical VLAN configured on the port. If no MAC authentication critical VLAN is configured, this field displays Not configured.
Critical voice VLAN | Whether the MAC authentication critical voice VLAN is enabled on the port.
Host mode | · If multi-VLAN mode is disabled, this field displays Single VLAN. · If multi-VLAN mode is enabled, this field displays Multiple VLAN.
Offline detection | Status of MAC authentication offline detection: · Enabled. · Disabled.
Authentication order | If parallel processing of MAC authentication and 802.1X authentication is disabled, this field displays Default. If parallel processing of MAC authentication and 802.1X authentication is enabled, this field displays Parallel.
Guest VSI | ‌ MAC authentication guest VSI configured on the port. If no MAC authentication guest VSI is configured, this field displays Not configured.
Guest VSI auth-period | ‌ Authentication interval for users in the MAC authentication guest VSI on the port.
Critical VSI | ‌ MAC authentication critical VSI configured on the port. If no MAC authentication critical VSI is configured, this field displays Not configured.
Auto-tag feature | ‌ Status of the authorization VLAN auto-tag feature: · Enabled. · Disabled.
VLAN tag configuration ignoring | ‌ Status of the ignore-config mode: · Enabled. · Disabled.
Max online users | Maximum number of concurrent online users allowed on the port.
Authentication attempts: successful 1, failed 0 | MAC authentication statistics, including the number of successful and unsuccessful authentication attempts.
MAC address | MAC address of the online user.
Auth state | User status: · Authenticated—The user has passed MAC authentication. · Unauthenticated—The user failed MAC authentication.
AP name | Name of the AP with which users are associated.
Radio ID | ID of the radio with which users are associated.
SSID | SSID with which users are associated.
BSSID | ID of the BSS with which users are associated.

MAC authentication commands -- display mac-authentication connection

Use display mac-authentication connection to display information about online MAC authentication users.

Syntax

Centralized devices:

display mac-authentication connection [ open ] [ ap ap-name [ radio radio-id ] | interface interface-type interface-number | user-mac mac-address | user-name user-name ]

Distributed devices in standalone mode:Centralized IRF devices:

display mac-authentication connection [ open ] [ ap ap-name [ radio radio-id ] | interface interface-type interface-number | slot slot-number | user-mac mac-address | user-name user-name ]

Distributed devices in IRF mode:

display mac-authentication connection [ open ] [ ap ap-name [ radio radio-id ] | chassis chassis-number slot slot-number | interface interface-type interface-number | user-mac mac-address | user-name user-name ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

open: Displays information only about MAC authentication users that use nonexistent usernames or incorrect passwords for network access in open authentication mode. If you do not specify this keyword, the command displays information about all online MAC authentication users.

ap ap-name: Specifies an AP by its name, a case-insensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-). If you do not specify an AP, this command displays information about online MAC authentication users for all APs.

radio radio-id: Specifies a radio by its ID. The value range for the radio-id argument varies by device model. If you do not specify a radio, this command displays information about online MAC authentication users for all radios on the specified AP.

interface interface-type interface-number: Specifies a port by its type and number. If you do not specify a port, this command displays information about online MAC authentication users for all ports.

slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays information about online MAC authentication users for all cards. (Distributed devices in standalone mode.)

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays information about online MAC authentication users for all member devices. (Centralized IRF devices.) (IRF 3 incapable.)

slot slot-number: Specifies an IRF member device by its member ID or specifies a PEX by its virtual slot number. On an IRF fabric, this command displays information for all member devices if you do not specify a member device. On an IRF 3 system, this command displays information for all IRF member devices and PEXs if you do not specify an IRF member device or PEX. (Centralized IRF devices.) (IRF 3 capable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays information about online MAC authentication users for all cards. (Distributed devices in IRF mode.) (IRF 3 incapable.)

chassis chassis-number slot slot-number: Specifies a card on an IRF member device or specifies a PEX. The chassis-number argument represents the member ID of the IRF member device or the virtual chassis number of the PEX. The slot-number argument represents the slot number of the card or PEX. On an IRF fabric, this command displays information for all cards if you do not specify a card. On an IRF 3 system, this command displays information for all cards and PEXs if you do not specify a card or PEX. (Distributed devices in IRF mode.) (IRF 3 capable.)

user-mac mac-address: Specifies an online MAC authentication user by its MAC address. The mac-address argument represents the MAC address of the user, in the form of H-H-H. If you do not specify an online MAC authentication user, this command displays all online MAC authentication user information.

user-name user-name: Specifies an online MAC authentication user by its username. The user name is a case-sensitive string of 1 to 55 characters, and it can include the domain name. If you do not specify an online MAC authentication user, this command displays all online MAC authentication user information.

Examples

# (Centralized devices.) Display information about all online MAC authentication users.

<Sysname> display mac-authentication connection

Total connections: 2

User MAC address: 0015-e9a6-7cfe

Access interface: GigabitEthernet1/0/1

Username: ias

User access state: Successful

Authentication domain: macusers

IPv4 address: 192.168.1.1

IPv6 address: 2000:0:0:0:1:2345:6789:abcd

Initial VLAN: 1

Authorization untagged VLAN: 100

Authorization tagged VLAN: N/A

Authorization VSI: N/A

Authorization ACL ID: 3001

Authorization user profile: N/A

Authorization CAR:

Average input rate: 102400

Peak input rate: 204800

Average output rate: 102400

Peak output rate: 204800

Termination action: Radius-request

Session timeout period: 2 s

Online from: 2013/03/02 13:14:15

Online duration: 0h 2m 15s

User MAC address : 0015-e9a6-7cfe

AP name : ap1

Radio ID : 1

SSID : wlan_dot1x_ssid

BSSID : 0015-e9a6-7cf0

User name : ias

Authentication domain : 1

Initial VLAN : 1

Authorization untagged VLAN : 100

Authorization ACL number : 3001

Authorization user profile : N/A

Authorization CAR : N/A

Termination action : Radius-request

Session timeout period : 2 sec

Online from : 2014/06/02 13:14:15

Online duration : 0h 2m 15s

# (Distributed devices in standalone mode.) (Centralized IRF devices.) Display information about all online MAC authentication users.

<Sysname> display mac-authentication connection

Total connections: 2

Slot ID: 0

User MAC address: 0015-e9a6-7cfe

Access interface: GigabitEthernet1/0/1

Username: ias

User access state: Successful

Authentication domain: macusers

IPv4 address: 192.168.1.1

IPv6 address: 2000:0:0:0:1:2345:6789:abcd

Initial VLAN: 1

Authorization untagged VLAN: 100

Authorization tagged VLAN: N/A

Authorization VSI: N/A

Authorization ACL ID: 3001

Authorization user profile: N/A

Authorization CAR:

Average input rate: 102400

Peak input rate: 204800

Average output rate: 102400

Peak output rate: 204800

Termination action: Radius-request

Session timeout period: 2 s

Online from: 2013/03/02 13:14:15

Online duration: 0h 2m 15s

User MAC address : 0015-e9a6-7cfe

AP name : ap1

Radio ID : 1

SSID : wlan_dot1x_ssid

BSSID : 0015-e9a6-7cf0

User name : ias

Authentication domain : 1

Initial VLAN : 1

Authorization untagged VLAN : 100

Authorization ACL number : 3001

Authorization user profile : N/A

Authorization CAR : N/A

Termination action : Radius-request

Session timeout period : 2 sec

Online from : 2014/06/02 13:14:15

Online duration : 0h 2m 15s

Table 2 Command output

Field | Description
Total connections | Total number of online MAC authentication users.
User MAC address | MAC address of the user.
Access interface | Interface through which the user accesses the device.
AP name | Name of the AP with which the user is associated.
Radio ID | ID of the radio with which the user is associated.
SSID | SSID with which the user is associated.
BSSID | ID of the BSS with which the user is associated.
User access state | Access state of the user: · Successful—The user passes MAC authentication and comes online. · Open—The user uses a nonexistent username or an incorrect password to come online in open authentication mode.
Authentication domain | MAC authentication domain to which the user belongs.
IPv4 address | IPv4 address of the user. If no user IPv4 address is available, this field is not displayed.
IPv6 address | IPv6 address of the user. If no user IPv6 address is available, this field is not displayed.
Initial VLAN | VLAN that holds the user before MAC authentication.
Authorization untagged VLAN | Untagged VLAN authorized to the user.
Authorization tagged VLAN | Tagged VLAN authorized to the user.
Authorization VSI | ‌ VSI authorized to the user.
Authorization ACL ID | ACL authorized to the user.
Authorization user profile | User profile authorized to the user.
Authorization CAR | ‌ Authorization CAR attributes assigned by the server. · Average input rate—Average rate of inbound traffic in bps. · Peak input rate—Peak rate of inbound traffic in bps. · Average output rate—Average rate of outbound traffic in bps. · Peak output rate—Peak rate of outbound traffic in bps. If the server does not assign the peak rates, the peak rates by default are the same as the assigned average rates. In the current software version, the device does not support exclusive assignment of peak rates from the server. If no authorization CAR attributes are assigned, this field displays N/A.
Termination action | Action attribute assigned by the server to terminate the user session: · Default—Logs off the online authenticated user when the session timeout timer expires. This attribute does not take effect when periodic MAC reauthentication is enabled and the periodic reauthentication timer is shorter than the session timeout timer. · Radius-request—Reauthenticates the online user when the session timeout timer expires, regardless of whether the periodic MAC reauthentication feature is enabled or not. If the device performs local authentication, this field displays Default.
Session timeout period | Session timeout timer assigned by the server.
Online from | Time from which the MAC authentication user came online.
Online duration | Online duration of the MAC authentication user.

MAC authentication commands -- display mac-authentication mac-address

Use display mac-authentication mac-address to display MAC address information of MAC authentication users in MAC authentication VLANs or VSIs of a specific type.

Syntax

display mac-authentication mac-address { critical-vlan | critical-vsi | guest-vlan | guest-vsi } [ interface interface-type interface-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

mdc-admin

mdc-operator

Parameters

critical-vlan: Specifies the MAC authentication critical VLAN.

critical-vsi: Specifies the MAC authentication critical VSI.

guest-vlan: Specifies the MAC authentication guest VLAN.

guest-vsi: Specifies the MAC authentication guest VSI.

interface interface-type interface-number: Specifies a port by its type and number. If you do not specify a port, this command displays MAC address information of MAC authentication users in the specified MAC authentication VLAN or VSI on all ports.

Usage guidelines

This command displays rough statistics. It might not fully display the specified information when a large number of MAC authentication users perform authentication frequently.

Examples

# Display MAC address information of MAC authentication users in the MAC authentication guest VLAN on all ports.

<Sysname> display mac-authentication mac-address guest-vlan

Total MAC addresses: 10

Interface: GigabitEthernet1/0/1 Guest VLAN: 3 Aging time: N/A

MAC addresses: 8

0800-2700-9427 0800-2700-2341 0800-2700-2324 0800-2700-2351

0800-2700-5627 0800-2700-2251 0800-2700-8624 0800-2700-3f51

Interface: GigabitEthernet1/0/2 Guest VLAN: 5 Aging time: 30 sec

MAC addresses: 2

0801-2700-9427 0801-2700-2341

# Display MAC address information of MAC authentication users in the MAC authentication guest VSI on all ports.

<Sysname> display mac-authentication mac-address guest-vsi

Total MAC addresses: 10

Interface: GigabitEthernet1/0/3 Guest VSI: text-vsi Aging time: N/A

MAC addresses: 8

0800-2700-9427 0800-2700-2341 0800-2700-2324 0800-2700-2351

0800-2700-5627 0800-2700-2251 0800-2700-8624 0800-2700-3f51

Interface: GigabitEthernet1/0/4 Guest VSI: text1-vsi Aging time: 30 sec

MAC addresses: 2

0801-2700-9427 0801-2700-2341

Table 3 Command output

Field | Description
Total MAC addresses | Total number of MAC addresses in the specified VLAN or VSI on the specified port or all ports.
Interface | Access port of MAC authentication users.
Type VLAN/VSI | VLAN or VSI information for MAC authentication users. The Type argument has the following values: · Critical VLAN. · Critical VSI. · Guest VLAN. · Guest VSI.
Aging time | MAC address aging time in seconds. This field displays N/A if the MAC addresses do not age out.
MAC addresses | Number of matching MAC addresses on a port.
xxxx-xxxx-xxxx | MAC address.

Related commands

mac-authentication critical vlan

mac-authentication critical vsi

mac-authentication guest-vlan

mac-authentication guest-vsi

MAC authentication commands -- mac-authentication

Use mac-authentication to enable MAC authentication globally or on a port.

Use undo mac-authentication to disable MAC authentication globally or on a port.

Syntax

mac-authentication

undo mac-authentication

Default

MAC authentication is disabled globally or on any port.

Views

System view

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

To use MAC authentication on a port, you must enable the feature both globally and on the port.

Support for MAC authentication depends on the device model. MAC authentication does not take effect on some device models.

Examples

# Enable MAC authentication globally.

<Sysname> system-view

[Sysname] mac-authentication

# Enable MAC authentication on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication

Related commands

display mac-authentication

MAC authentication commands -- mac-authentication access-user log enable

Use mac-authentication access-user log enable to enable logging for MAC authentication users.

Use undo mac-authentication access-user log enable to disable logging for MAC authentication users.

Syntax

mac-authentication access-user log enable [ failed-login | logoff | successful-login ] *

undo mac-authentication access-user log enable [ failed-login | logoff | successful-login ] *

Default

Logging for MAC authentication users is disabled.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

failed-login: Specifies logs generated for login failures of MAC authentication users.

logoff: Specifies logs generated for logoffs of MAC authentication users.

successful-login: Specifies logs generated for successful logins of MAC authentication users.

Usage guidelines

As a best practice, disable this feature to prevent excessive output of logs for MAC authentication users.

If you do not specify any parameters, this command enables all logging functions for MAC authentication users.

Examples

# Enable logging for login failures of MAC authentication users.

<Sysname> system-view

[Sysname] mac-authentication access-user log enable failed-login

Related commands

info-center source maca logfile deny (Network Management and Monitoring Command Reference)

MAC authentication commands -- mac-authentication auto-tag

Use mac-authentication auto-tag to enable the authorization VLAN auto-tag feature for MAC authentication.

Use undo mac-authentication auto-tag to disable the authorization VLAN auto-tag feature for MAC authentication.

Syntax

mac-authentication auto-tag [ ignore-config ]

undo mac-authentication auto-tag

Default

The authorization VLAN auto-tag feature is disabled for MAC authentication. The AAA server's configuration of the port's tagging status in the authorization VLAN applies.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

mdc-admin

Parameters

ignore-config: Specifies the ignore-config mode to ignore the static VLAN assignment configuration for a port. In ignore-config mode, whether the port is assigned to the authorization VLAN as a tagged member is determined only by the authorization VLAN auto-tag feature.

Usage guidelines

This command takes effect only on hybrid ports that are enabled with MAC-based VLAN.

The port's tagging status configuration in the authorization VLAN by this command takes precedence over the AAA server's configuration of the port's tagging status in the authorization VLAN. However, when the authorization VLAN is the port VLAN, this command does not take effect.

When the ignore-config mode is disabled, the tagging status of the port in the authorization VLAN is determined by the static VLAN assignment configuration for the port. For information about the static VLAN assignment configuration for a port, see the port hybrid vlan vlan-list { tagged | untagged } command in Layer 2—LAN Switching Command Reference.

When a port is enabled with the authorization VLAN auto-tag feature, do not use the undo vlan command to delete the authorization VLANs authorized to authenticated users.

When you configure this command on a port, make sure the port does not have online users. This command will not take effect if there are online users.

Examples

# Enable the authorization VLAN auto-tag feature on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication auto-tag ignore-config

Related commands

display mac-authentication

display mac-authentication connection

mac-authentication

MAC authentication commands -- mac-authentication carry user-ip

Use mac-authentication carry user-ip to include user IP addresses in MAC authentication requests sent to an IMC server.

Use undo mac-authentication carry user-ip to restore the default.

Syntax

mac-authentication carry user-ip

undo mac-authentication carry user-ip

Default

A MAC authentication request does not include the user IP address.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

This command solves the IP conflict issue which might be caused by users' IP address modification. After you configure this command, users cannot pass MAC authentication if the IP and MAC information in the authentication requests do not match the users' IP-MAC mappings on the IMC server.

The IMC server selects the IP-MAC combination for a MAC authentication user to match in the following order:

1. The IP and MAC addresses in the IMC platform user account associated with the MAC authentication user.

2. The IP and MAC addresses that are included in the authentication request. If the server does not have an authenticated IP-MAC record for the user, it determines that the IP-MAC combination of the user is valid. The server will record the IP-MAC combination of the user. If the user IP address is changed at the next authentication, the user cannot pass authentication.

This command takes effect only on MAC authentication users that use static IP addresses. Users that obtain IP addresses through DHCP are not affected.

Do not configure this command together with the mac-authentication guest-vlan command on a port. If both commands are configured, users in the MAC authentication guest VLAN cannot perform a new round of authentication.

Examples

# Include user IP addresses in MAC authentication requests on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication carry user-ip

Related commands

mac-authentication

MAC authentication commands -- mac-authentication critical vlan

Use mac-authentication critical vlan to configure a MAC authentication critical VLAN on a port.

Use undo mac-authentication critical vlan to restore the default.

Syntax

mac-authentication critical vlan critical-vlan-id

undo mac-authentication critical vlan

Default

No MAC authentication critical VLAN exists on a port.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Parameters

critical-vlan-id: Specifies a VLAN as the MAC authentication critical VLAN. The value range for the VLAN ID is 1 to 4094. Make sure the VLAN has been created.

Usage guidelines

The MAC authentication critical VLAN accommodates users that have failed MAC authentication because all the servers in their ISP domains are unreachable. Users in the critical VLAN can access network resources in the critical VLAN.

You cannot specify a VLAN as both a super VLAN and a MAC authentication critical VLAN on a port. For more information about super VLANs, see Layer 2—LAN Switching Configuration Guide.

On a port, the MAC authentication critical VLAN configuration is mutually exclusive with the MAC authentication guest VSI and MAC authentication critical VSI settings.

The critical VLAN feature takes effect when MAC authentication is performed only through RADIUS servers. If a MAC authentication user fails local authentication after RADIUS authentication, the user is not assigned to the critical VLAN.

Before you delete a VLAN that has been set as a MAC authentication critical VLAN, use the undo mac-authentication critical vlan command to remove the critical VLAN configuration.

Examples

# Configure VLAN 100 as the MAC authentication critical VLAN on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication critical vlan 100

Related commands

display mac-authentication

reset mac-authentication critical vlan

MAC authentication commands -- mac-authentication critical vsi

Use mac-authentication critical vsi to configure a MAC authentication critical VSI on a port.

Use undo mac-authentication critical vsi to restore the default.

Syntax

mac-authentication critical vsi critical-vsi-name

undo mac-authentication critical vsi

Default

No MAC authentication critical VSI exists on a port.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Parameters

critical-vsi-name: Specifies the name of the MAC authentication critical VSI on the port, a case-sensitive string of 1 to 31 characters.

Usage guidelines

The MAC authentication critical VSI accommodates users that have failed MAC authentication because all the servers in their ISP domains are unreachable. Users in the critical VSI can access only network resources in the VXLAN associated with this VSI.

You can configure only one MAC authentication critical VSI on a port. The MAC authentication critical VSIs on different ports can be different.

On a port, the MAC authentication critical VSI configuration is mutually exclusive with the MAC authentication guest VLAN and MAC authentication critical VLAN settings.

Examples

# Configure VSI vpna as the MAC authentication critical VSI on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication critical vsi vpna

Related commands

display mac-authentication

reset mac-authentication critical vsi

MAC authentication commands -- mac-authentication critical-voice-vlan

Use mac-authentication critical-voice-vlan to enable the MAC authentication critical voice VLAN on a port.

Use undo mac-authentication critical-voice-vlan to restore the default.

Syntax

mac-authentication critical-voice-vlan

undo mac-authentication critical-voice-vlan

Default

The MAC authentication critical voice VLAN is disabled on a port.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

The MAC authentication critical voice VLAN on a port accommodates MAC authentication voice users that have failed authentication because none of the RADIUS servers in their ISP domain are reachable.

Before you enable the MAC authentication critical voice VLAN on the port, make sure the following requirements are met:

· The port is configured with the voice VLAN.

To configure a voice VLAN on a port, use the voice-vlan enable command (see Layer 2—LAN Switching Command Reference).

· LLDP is enabled both globally and on the port.

The device uses LLDP to identify voice users. For information about LLDP commands, see Layer 2—LAN Switching Command Reference.

Examples

# Enable the MAC authentication critical voice VLAN on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication critical-voice-vlan

Related commands

display mac-authentication

lldp enable (Layer 2—LAN Switching Command Reference)

lldp global enable (Layer 2—LAN Switching Command Reference)

reset mac-authentication critical-voice-vlan

voice-vlan enable (Layer 2—LAN Switching Command Reference)

MAC authentication commands -- mac-authentication domain

Use mac-authentication domain to specify a global or port-specific authentication domain.

Use undo mac-authentication domain to restore the default.

Syntax

mac-authentication domain domain-name

undo mac-authentication domain

Default

The system default authentication domain is used. For more information about the default authentication domain, see the domain default enable command in "AAA commands."

Views

System view

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Parameters

domain-name: Specifies the name of an ISP domain, a case-insensitive string of 1 to 255 characters.

Usage guidelines

The global authentication domain applies to all MAC authentication-enabled ports. An authentication domain specified in Layer 2 Ethernet interface view or Layer 2 aggregate interface view applies only to the port. You can specify different authentication domains on different ports.

A port chooses an authentication domain for MAC authentication users in the following order:

1. Authentication domain specified on the port.

2. Global authentication domain specified in system view.

3. Default authentication domain.

Examples

# Specify ISP domain domain1 as the global MAC authentication domain.

<Sysname> system-view

[Sysname] mac-authentication domain domain1

# Specify ISP domain aabbcc as the MAC authentication domain on GigabitEthernet 1/0/1.

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication domain aabbcc

Related commands

display mac-authentication

domain default enable

MAC authentication commands -- mac-authentication guest-vlan

Use mac-authentication guest-vlan to configure a MAC authentication guest VLAN on a port.

Use undo mac-authentication guest-vlan to restore the default.

Syntax

mac-authentication guest-vlan guest-vlan-id

undo mac-authentication guest-vlan

Default

No MAC authentication guest VLAN exists on a port.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Parameters

guest-vlan-id: Specifies a VLAN as the MAC authentication guest VLAN. The value range for the VLAN ID is 1 to 4094. Make sure the VLAN has been created.

Usage guidelines

The MAC authentication guest VLAN accommodates users that have failed MAC authentication for any reason other than server unreachable. For example, the VLAN accommodates users with invalid passwords entered. You can deploy a limited set of network resources in the MAC authentication guest VLAN. For example, a software server for downloading software and system patches.

You cannot specify a VLAN as both a super VLAN and a MAC authentication guest VLAN on a port. For more information about super VLANs, see Layer 2—LAN Switching Configuration Guide.

On a port, the MAC authentication guest VLAN configuration is mutually exclusive with the MAC authentication guest VSI and MAC authentication critical VSI settings.

Before you delete a VLAN that has been set as a MAC authentication guest VLAN, use the undo mac-authentication guest-vlan command to remove the guest VLAN configuration.

Examples

# Configure VLAN 100 as the MAC authentication guest VLAN on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication guest-vlan 100

Related commands

display mac-authentication

reset mac-authentication guest-vlan

MAC authentication commands -- mac-authentication guest-vlan auth-period

Use mac-authentication guest-vlan auth-period to set the interval at which the device authenticates users in the MAC authentication guest VLAN.

Use undo mac-authentication guest-vlan auth-period to restore the default.

Syntax

mac-authentication guest-vlan auth-period period-value

undo mac-authentication guest-vlan auth-period

Default

The device authenticates users in the MAC authentication guest VLAN every 30 seconds.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Parameters

period-value: Specifies the authentication interval for users in the MAC authentication guest VLAN. The value range is 1 to 3600, in seconds.

Examples

# Set the authentication interval to 150 seconds for users in the MAC authentication guest VLAN on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication guest-vlan auth-period 150

Related commands

display mac-authentication

mac-authentication guest-vlan

MAC authentication commands -- mac-authentication guest-vsi

Use mac-authentication guest-vsi to configure a MAC authentication guest VSI on a port.

Use undo mac-authentication guest-vsi to restore the default.

Syntax

mac-authentication guest-vsi guest-vsi-name

undo mac-authentication guest-vsi

Default

No MAC authentication guest VSI exists on a port.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Parameters

guest-vsi-name: Specifies the name of the MAC authentication guest VSI on the port, a case-sensitive string of 1 to 31 characters.

Usage guidelines

The MAC authentication guest VSI accommodates users that have failed MAC authentication for any reason other than server unreachable. For example, the VSI accommodates users with invalid passwords entered. You can deploy a limited set of network resources in the VXLAN that is associated with the guest VSI. For example, a software server for downloading software and system patches.

You can configure only one MAC authentication guest VSI on a port. The MAC authentication guest VSIs on different ports can be different.

On a port, the MAC authentication guest VSI configuration is mutually exclusive with the MAC authentication guest VLAN and MAC authentication critical VLAN settings.

Examples

# Configure VSI vpna as the MAC authentication guest VSI on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication guest-vsi vpna

Related commands

display mac-authentication

reset mac-authentication guest-vsi

MAC authentication commands -- mac-authentication guest-vsi auth-period

Use mac-authentication guest-vsi auth-period to set the interval at which the device authenticates users in the MAC authentication guest VSI.

Use undo mac-authentication guest-vsi auth-period to restore the default.

Syntax

mac-authentication guest-vsi auth-period period-value

undo mac-authentication guest-vsi auth-period

Default

The device authenticates users in the MAC authentication guest VSI every 30 seconds.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Parameters

period-value: Specifies the authentication interval for users in the MAC authentication guest VSI. The value range is 1 to 3600, in seconds.

Examples

# Set the authentication interval to 150 seconds for users in the MAC authentication guest VSI on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication guest-vsi auth-period 150

Related commands

display mac-authentication

mac-authentication guest-vsi

MAC authentication commands -- mac-authentication host-mode

Use mac-authentication host-mode multi-vlan to enable MAC authentication multi-VLAN mode on a port.

Use undo mac-authentication host-mode to restore the default.

Syntax

mac-authentication host-mode multi-vlan

undo mac-authentication host-mode

Default

MAC authentication multi-VLAN mode is disabled on a port. When the port receives a packet sourced from an authenticated MAC address in a VLAN not matching the existing MAC-VLAN mapping, the device logs off and reauthenticates the user.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

The MAC authentication multi-VLAN mode prevents an authenticated online user from service interruption caused by VLAN changes on a port. When the port receives a packet sourced from the user in a VLAN not matching the existing MAC-VLAN mapping, the device neither logs off the user nor reauthenticates the user. The device creates a new MAC-VLAN mapping for the user, and traffic transmission is not interrupted. The original MAC-VLAN mapping for the user remains on the device until it dynamically ages out. As a best practice, configure this feature on hybrid or trunk ports.

This feature improves transmission of data that is vulnerable to delay and interference. It is typically applicable to IP phone users.

Examples

# Enable MAC authentication multi-VLAN mode on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication host-mode multi-vlan

Related commands

display mac-authentication

MAC authentication commands -- mac-authentication max-user

Use mac-authentication max-user to set the maximum number of concurrent MAC authentication users on a port.

Use undo mac-authentication max-user to restore the default.

Syntax

mac-authentication max-user max-number

undo mac-authentication max-user

Default

The maximum number of concurrent MAC authentication users on a port varies by device model.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Parameters

max-number: Specifies the maximum number of concurrent MAC authentication users on the port. The value range for this argument varies by device model.

Usage guidelines

Set the maximum number of concurrent MAC authentication users on a port to prevent the system resources from being overused. When the maximum number is reached, the port denies subsequent MAC authentication users.

Examples

# Configure GigabitEthernet 1/0/1 to support a maximum of 32 concurrent MAC authentication users.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication max-user 32

Related commands

display mac-authentication

MAC authentication commands -- mac-authentication offline-detect enable

Use mac-authentication offline-detect enable to enable MAC authentication offline detection on a port.

Use undo mac-authentication offline-detect enable to disable MAC authentication offline detection.

Syntax

mac-authentication offline-detect enable

undo mac-authentication offline-detect enable

Default

MAC authentication offline detection is enabled on a port.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

This command allows the device to log out a user if the device does not receive any packets from the user within the offline detect timer. The device also requests to stop accounting for the user at the same time. To set the offline detect timer, use the mac-authentication timer command.

The undo mac-authentication offline-detect enable command disables the device from inspecting the online user status.

Examples

# Disable MAC authentication offline detection on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] undo mac-authentication offline-detect enable

Related commands

mac-authentication timer

MAC authentication commands -- mac-authentication parallel-with-dot1x

Use mac-authentication parallel-with-dot1x to enable parallel processing of MAC authentication and 802.1X authentication on a port.

Use undo mac-authentication parallel-with-dot1x to restore the default.

Syntax

mac-authentication parallel-with-dot1x

undo mac-authentication parallel-with-dot1x

Default

Parallel processing of MAC authentication and 802.1X authentication is disabled on a port.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

When you configure this command on a port, follow these restrictions and guidelines:

· Make sure the port meets the following requirements:

?span style='font:7.0pt "Times New Roman"'> The port is configured with both 802.1X authentication and MAC authentication and performs MAC-based access control for 802.1X authentication.

?span style='font:7.0pt "Times New Roman"'> The port is enabled with the 802.1X unicast trigger.

· For the port to perform MAC authentication before it is assigned to the 802.1X guest VLAN, use the dot1x guest-vlan-delay new-mac command to delay assigning the port to the 802.1X guest VLAN.

For information about the dot1x guest-vlan-delay new-mac command, see "802.1X commands."

· Do not enable MAC authentication delay on the port. This operation will delay MAC authentication after 802.1X authentication is triggered.

· To configure both 802.1X authentication and MAC authentication on the port, use one of the following methods:

?span style='font:7.0pt "Times New Roman"'> Enable the 802.1X and MAC authentication features separately on the port.

?span style='font:7.0pt "Times New Roman"'> Enable port security on the port. The port security mode must be userlogin-secure-or-mac or userlogin-secure-or-mac-ext.

For information about port security mode configuration, see port security in Security Configuration Guide.

Examples

# Enable parallel processing of MAC authentication and 802.1X authentication on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication parallel-with-dot1x

Related commands

display mac-authentication

MAC authentication commands -- mac-authentication re-authenticate

Use mac-authentication re-authenticate to enable the periodic MAC reauthentication feature on a port.

Use undo mac-authentication re-authenticate to disable the periodic MAC reauthentication feature on a port.

Syntax

mac-authentication re-authenticate

undo mac-authentication re-authenticate

Default

The periodic MAC reauthentication feature is disabled on a port.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

Periodic MAC reauthentication enables the access device to periodically authenticate online MAC authentication users on a port. This feature tracks the connection status of online users and updates the authorization attributes assigned by the server, such as the ACL and VLAN.

To set the periodic reauthentication timer, use the mac-authentication timer reauth-period command in system view or in Ethernet interface view.

Examples

# Enable the periodic MAC reauthentication feature on GigabitEthernet 1/0/1 and set the global periodic reauthentication timer to 1800 seconds.

<Sysname> system-view

[Sysname] mac-authentication timer reauth-period 1800

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication re-authenticate

Related commands

display mac-authentication

mac-authentication timer

MAC authentication commands -- mac-authentication re-authenticate server-unreachable keep-online

Use mac-authentication re-authenticate server-unreachable keep-online to enable the keep-online feature on a port.

Use undo mac-authentication re-authenticate server-unreachable to restore the default.

Syntax

mac-authentication re-authenticate server-unreachable keep-online

undo mac-authentication re-authenticate server-unreachable

Default

The keep-online feature is disabled on a port. The device logs off online MAC authentication users if no server is reachable for MAC reauthentication.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Usage guidelines

The keep-online feature keeps authenticated MAC authentication users online when no server is reachable for MAC reauthentication.

Examples

# Enable the keep-online feature for authenticated MAC authentication users on GigabitEthernet 1/0/1.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication re-authenticate server-unreachable keep-online

Related commands

display mac-authentication

MAC authentication commands -- mac-authentication timer (interface view)

Use mac-authentication timer to configure a MAC authentication timer on a port.

Use undo mac-authentication timer to restore the default of a MAC authentication timer.

Syntax

mac-authentication timer { auth-delay auth-delay-time | reauth-period reauth-period-value }

undo mac-authentication timer { auth-delay | reauth-period }

Default

No MAC authentication delay timer is set on a port. MAC authentication delay is disabled. MAC authentication starts immediately after it is triggered by a user packet.

No periodic MAC reauthentication timer is set on a port. The port uses the global periodic MAC reauthentication timer.

Views

Layer 2 Ethernet interface view

Layer 2 aggregate interface view

Predefined user roles

network-admin

mdc-admin

Parameters

auth-delay auth-delay-time: Specifies the delay time for MAC authentication in seconds. The value range is 1 to 180.

reauth-period reauth-period-value: Specifies the port-specific periodic MAC reauthentication timer in seconds. The value range is 60 to 7200.

Usage guidelines

When both 802.1X authentication and MAC authentication are enabled on a port, you can delay MAC authentication so that 802.1X authentication is preferentially triggered. If no 802.1X authentication is triggered or if 802.1X authentication fails within the delay period, the port continues to process MAC authentication.

Do not set the port security mode to mac-else-userlogin-secure or mac-else-userlogin-secure-ext when you want to use MAC authentication delay. The delay does not take effect on a port in either of the two modes. For more information about port security modes, see "Port security commands."

The device reauthenticates online MAC authentication users on a port at the specified periodic reauthentication interval if the port is enabled with periodic MAC reauthentication. To enable periodic MAC reauthentication on a port, use the mac-authentication re-authenticate command.

A change to the port-specific periodic reauthentication timer applies to online users only after the old timer expires.

The device selects a periodic reauthentication timer for MAC reauthentication in the following order:

1. Server-assigned reauthentication timer.

2. Port-specific reauthentication timer.

3. Global reauthentication timer.

4. Default reauthentication timer.

Examples

# Enable MAC authentication delay on GigabitEthernet 1/0/1 and set the delay time to 10 seconds.

<Sysname> system-view

[Sysname] interface gigabitethernet 1/0/1

[Sysname-GigabitEthernet1/0/1] mac-authentication timer auth-delay 10

Related commands

display mac-authentication

port-security port-mode

MAC authentication commands -- mac-authentication timer (system view)

Use mac-authentication timer to configure a MAC authentication timer.

Use undo mac-authentication timer to restore the default of a MAC authentication timer.

Syntax

mac-authentication timer { offline-detect offline-detect-value | quiet quiet-value | reauth-period reauth-period-value | server-timeout server-timeout-value }

undo mac-authentication timer { offline-detect | quiet | reauth-period | server-timeout }

Default

The following MAC authentication timers apply:

· The offline detect timer is 300 seconds.

· The quiet timer is 60 seconds.

· The global periodic MAC reauthentication timer is 3600 seconds.

· The server timeout timer is 100 seconds.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

offline-detect offline-detect-value: Specifies the offline detect timer in the range of 60 to 2147483647, in seconds.

quiet quiet-value: Specifies the quiet timer in the range of 1 to 3600, in seconds.

reauth-period reauth-period-value: Specifies the global periodic MAC reauthentication timer in the range of 60 to 7200, in seconds.

server-timeout server-timeout-value: Specifies the server timeout timer in the range of 100 to 300, in seconds.

Usage guidelines

MAC authentication uses the following timers:

· Offline detect timer—Sets the interval that the device waits for traffic from a user before the device regards the user as idle. The device logs off the user and requests to stop accounting for the user after the timer expires. This timer takes effect only when the MAC authentication offline detection feature is enabled.

After you set the offline detect timer, assign the same value to the MAC address aging timer by using the mac-address timer command. This operation prevents a MAC authenticated user from being offline within the offline detect timer due to MAC address entry expiration.

· Quiet timer—Sets the interval that the device must wait before the device can perform MAC authentication for a user that has failed MAC authentication. All packets from the MAC address are dropped during the quiet time. This quiet mechanism prevents repeated authentication from affecting system performance.

· Periodic MAC reauthentication timer—Sets the interval at which the device reauthenticates online MAC authentication users on a port if the port is enabled with periodic MAC reauthentication. A change to the global periodic reauthentication timer applies to online users only after the old timer expires.

· Server timeout timer—Sets the interval that the device waits for a response from a RADIUS server before the device regards the RADIUS server unavailable. If the timer expires during MAC authentication, the user cannot access the network.

Examples

# Set the server timeout timer to 150 seconds.

<Sysname> system-view

[Sysname] mac-authentication timer server-timeout 150

Related commands

display mac-authentication

MAC authentication commands -- mac-authentication user-name-format

Use mac-authentication user-name-format to configure the type of user accounts for MAC authentication users.

Use undo mac-authentication user-name-format to restore the default.

Syntax

mac-authentication user-name-format { fixed [ account name ] [ password { cipher | simple } string ] | mac-address [ { with-hyphen | without-hyphen } [ lowercase | uppercase ] ] }

undo mac-authentication user-name-format

Default

Each user's MAC address is used as the username and password for MAC authentication. A MAC address is in the hexadecimal notation without hyphens, and letters are in lower case.

Views

System view

Predefined user roles

network-admin

mdc-admin

Parameters

fixed: Uses a shared account for all MAC authentication users.

account name: Specifies the username for the shared account. The name is a case-sensitive string of 1 to 55 characters, excluding the at sign (@). If you do not specify a username, the default name mac applies.

password: Specifies the password for the shared user account.

cipher: Specifies a password in encrypted form.

simple: Specifies a password in plaintext form. For security purposes, the password specified in plaintext form will be stored in encrypted form.

string: Specifies the password. Its plaintext form is a case-sensitive string of 1 to 63 characters. Its encrypted form is a case-sensitive string of 1 to 117 characters.

mac-address: Uses MAC-based user accounts for MAC authentication users. You can also specify the format of username and password by using the following keywords:

· with-hyphen: Includes hyphens in the MAC address, for example xx-xx-xx-xx-xx-xx.

· without-hyphen: Excludes hyphens from the MAC address, for example, xxxxxxxxxxxx.

· lowercase: Enters letters in lower case.

· uppercase: Enters letters in upper case.

Usage guidelines

If you specify the MAC-based user account, the device uses the MAC address of a user as the username and password for MAC authentication of the user. This user account type ensures high authentication security. However, you must create on the authentication server a user account for each user, using the MAC address of the user as both the username and password.

If you specify a shared user account, the device uses the specified username and password for MAC authentication of all users. Because all MAC authentication users use a single account for authentication, you only need to create one account on the authentication server. This user account type is suitable for trusted networks.

Examples

# Configure a shared account for MAC authentication users, and set the username to abc and password to plaintext string of xyz.

<Sysname> system-view

[Sysname] mac-authentication user-name-format fixed account abc password simple xyz

# Use MAC-based user accounts for MAC authentication users. Each MAC address must be in the hexadecimal notation with hyphens, and letters are in upper case.

<Sysname> system-view

[Sysname] mac-authentication user-name-format mac-address with-hyphen uppercase

Related commands

display mac-authentication

MAC authentication commands -- reset mac-authentication critical vlan

Use reset mac-authentication critical vlan to remove users from the MAC authentication critical VLAN on a port.

Syntax

reset mac-authentication critical vlan interface interface-type interface-number [ mac-address mac-address ]

Views

User view

Predefined user roles

network-admin

mdc-admin

Parameters

interface interface-type interface-number: Specifies a port by its type and number.

mac-address mac-address: Specifies a user by its MAC address. If you do not specify this option, the command removes all users from the MAC authentication critical VLAN on the port.

Examples

# Remove the user with MAC address 1-1-1 from the MAC authentication critical VLAN on GigabitEthernet 1/0/1.

<Sysname> reset mac-authentication critical vlan interface gigabitethernet 1/0/1 mac-address 1-1-1

Related commands

display mac-authentication

mac-authentication critical vlan

MAC authentication commands -- reset mac-authentication critical vsi

Use reset mac-authentication critical vsi to remove users from the MAC authentication critical VSI on a port.

Syntax

reset mac-authentication critical vsi interface interface-type interface-number [ mac-address mac-address ]

Views

User view

Predefined user roles

network-admin

mdc-admin

Parameters

interface interface-type interface-number: Specifies a port by its type and number.

mac-address mac-address: Specifies a user by its MAC address. If you do not specify this option, the command removes all users from the MAC authentication critical VSI on the port.

Examples

# Remove the user with MAC address 1-1-1 from the MAC authentication critical VSI on GigabitEthernet 1/0/1.

<Sysname> reset mac-authentication critical vsi interface gigabitethernet 1/0/1 mac-address 1-1-1

Related commands

display mac-authentication

mac-authentication critical vsi

MAC authentication commands -- reset mac-authentication critical-voice-vlan

Use reset mac-authentication critical-voice-vlan to remove MAC authentication users from the MAC authentication critical voice VLAN on a port.

Syntax

reset mac-authentication critical-voice-vlan interface interface-type interface-number [ mac-address mac-address ]

Views

User view

Predefined user roles

network-admin

mdc-admin

Parameters

interface interface-type interface-number: Specifies a port by its type and number.

mac-address mac-address: Specifies a user by its MAC address. If you do not specify this option, the command removes all users from the MAC authentication critical voice VLAN on the port.

Examples

# Remove the user with MAC address 1-1-1 from the MAC authentication critical voice VLAN on GigabitEthernet 1/0/1.

<Sysname> reset mac-authentication critical-voice-vlan interface gigabitethernet 1/0/1 mac-address 1-1-1

Related commands

display mac-authentication

mac-authentication critical-voice-vlan

MAC authentication commands -- reset mac-authentication guest-vlan

Use reset mac-authentication guest-vlan to remove users from the MAC authentication guest VLAN on a port.

Syntax

reset mac-authentication guest-vlan interface interface-type interface-number [ mac-address mac-address ]

Views

User view

Predefined user roles

network-admin

mdc-admin

Parameters

interface interface-type interface-number: Specifies a port by its type and number.

mac-address mac-address: Specifies a user by its MAC address. If you do not specify this option, the command removes all users from the MAC authentication guest VLAN on the port.

Examples

# Remove the user with MAC address 1-1-1 from the MAC authentication guest VLAN on GigabitEthernet 1/0/1.

<Sysname> reset mac-authentication guest-vlan interface gigabitethernet 1/0/1 mac-address 1-1-1

Related commands

display mac-authentication

mac-authentication guest-vlan

MAC authentication commands -- reset mac-authentication guest-vsi

Use reset mac-authentication guest-vsi to remove users from the MAC authentication guest VSI on a port.

Syntax

reset mac-authentication guest-vsi interface interface-type interface-number [ mac-address mac-address ]

Views

User view

Predefined user roles

network-admin

mdc-admin

Parameters

interface interface-type interface-number: Specifies a port by its type and number.

mac-address mac-address: Specifies a user by its MAC address. If you do not specify this option, the command removes all users from the MAC authentication guest VSI on the port.

Examples

# Remove the user with MAC address 1-1-1 from the MAC authentication guest VSI on GigabitEthernet 1/0/1.

<Sysname> reset mac-authentication guest-vsi interface gigabitethernet 1/0/1 mac-address 1-1-1

Related commands

display mac-authentication

mac-authentication guest-vsi

MAC authentication commands -- reset mac-authentication statistics

Use reset mac-authentication statistics to clear MAC authentication statistics.

Syntax

reset mac-authentication statistics [ ap ap-name [ radio radio-id ] | interface interface-type interface-number ]

Views

User view

Predefined user roles

network-admin

mdc-admin

Parameters

ap ap-name: Specifies an AP by its name, a case-insensitive string of 1 to 64 characters. The string can contain letters, digits, underscores (_), left brackets ([), right brackets (]), forward slashes (/), and hyphens (-). If you do not specify an AP, this command clears MAC authentication statistics for all APs.

radio radio-id: Specifies a radio by its ID. The value range for the radio-id argument varies by device model. If you do not specify a radio, this command clears MAC authentication statistics for all radios on the specified AP.

interface interface-type interface-number: Specifies a port by its type and number. If you do not specify a port, this command clears both global and port-specific MAC authentication statistics.

Examples

# Clear MAC authentication statistics on GigabitEthernet 1/0/1.

<Sysname> reset mac-authentication statistics interface gigabitethernet 1/0/1

Related commands

display mac-authentication