802.1x下mac地址旁路认证环境

802.1X

认证

测试环境

WIN 2003 SER(X86) SP2+CISCO ACS SERVER v4.2

认证服务器一

WIN 2003 SER(X86) SP2+DNS+AD+IAS+IIS+CA

认证服务器二

CISCO 3560(Version 12.2(55)SE3)

网络设备

参考资料

Configure the RADIUS Server with Client MAC Addresses ACS

配置

/en/US/docs/net_mgmt/cisco_ secure_access_control_server_for_windows/4.

0/user/guide/

ACS4.0

手册

/en/US/products/sw/secursw/ ps2086/products_configuration_guide_chapter

/en/US/tech /tk722/tk809/technologies_configuration_example091 86a00808

MAC Authentication Bypass

/u nivercd/cc/td/doc/solution/

以下内容摘自

CISCO 3560

命令手册

You can configure the switch to authorize clients based on the client MAC address (see Figure 9-2

on page 9-5) by using the MAC authentication bypass feature. For example, you can enable this

feature on 802.1x ports connected to devices such as printers.

If

802.1x

authentication

times

out

while

waiting

for

an

EAPOL

response

from

the

client,

the

switch tries to authorize the client by using MAC authentication bypass.

When the MAC authentication bypass feature is enabled on an 802.1x port, the switch uses the

MAC

address

as

the

client

identity.

The

authentication

server

has

a

database

of

client

MAC

addresses that are allowed network access. After detecting a client on an 802.1x port, the switch

waits

for

an

Ethernet

packet

from

the

client.

The

switch

sends

the

authentication

server

a

RADIUS-access/request

frame

with

a

username

and

password

based

on

the

MAC

address.

If

authorization succeeds, the switch grants the client access to the network. If authorization fails, the

switch assigns the port to the guest VLAN if one is configured.

以下内容摘自

Quidway

S5300

系列以太网交换机

配置指南

2.4.4

（可选）使能

MAC

旁路认证功能

< br>

背景信息

MAC

802.1x

认证失败后 ，把它的

MAC

地址作为用户名和密码上送

RADIUS

服

务器进行认证。对于某些特殊终端，例如打 印机等，无法使用和安装

802.1x

终端软件，可以通过基于

MA

C

的旁路认证方式进行认证。

配置

MAC

旁路 认证，有以下两种配置方法：

操作步骤

?

系统视图下

1.

执行命令

system- view

，进入系统视图。

2.

执行命令

dot1x

mac- bypass

interface

{

interface-type

interface-number1

[

to

interface-

number2

]

}

&<1-10>

，使能接口

MAC

旁路认证功能。

< br>

系统视图下执行

dot1x

mac-bypass

命令时指定接口列表，

< br>可以批量配置接口

MAC

旁路

认 证功能。

?

接口视图下

1.

执行命令

system- view

，进入系统视图。

2.

执行命令

interface

interface-type

interface- number

，进入接口视图。

3.

执行命令

dot1x

mac-byp ass

，在接口下使能

MAC

旁路认证 功能。

执行本命令将包含并覆盖该接口下的

< br>802.1x

使能命令，即

o

如果接口下原来没有使能