配置华三交换机1x和1x+mac复合认证

一、仅做dot1x认证

1. 全局配置

dot1x

dot1x authentication-method eap

dot1x timer tx-period 10

1.  创建radius服务模板

radius scheme 1x-test

primary authentication 10.10.10.10 key simple 123456

primary accounting 10.10.10.10 key simple 123456

secondary authentication 10.10.10.11 key simple 123456

secondary accounting 10.10.10.11 key simple 123456

user-name-format whithout-domain

accounting-on enable

1. 创建ISP域

domain 1x-domain

authentication lan-access radius-scheme 1x-test

authorization lan-access radius-scheme 1x-test

accounting lan-access radius-scheme 1x-test

access-limit disable

state active

idle-cut disable

1. 接口开启802.1x认证

interface g0/0/1

port link-type hybrid

port hybrid vlan 100,110,120 untagged

port hybrid pvid vlan 10

mac-vlan enable

dot1x guest-vlan 100        //guest-vlan

dot1x auth-fail vlan 110    //认证失败vlan

dot1x critical vlan 120     //逃生vlan

undo dot1x handshake

dot1x mandatory-domain 1x-domain

undo dot1x multicast-trigger

dot1x

dot1x unicast-trigger

1. COA配置（踢设备下线）

radius dynamic-author server

client ip 10.10.10.10 key simple 123456

 

二、1x+mac复合认证

1. 全局配置

dot1x authentication-method eap

dot1x timer tx-period 10

mac-authentication domain 1x-domain

port-security enable

1. 创建radius服务模板

radius scheme 1x-test

primary authentication 10.10.10.10 key simple 123456

primary accounting 10.10.10.10 key simple 123456

secondary authentication 10.10.10.11 key simple 123456

secondary accounting 10.10.10.11 key simple 123456

user-name-format whithout-domain

accounting-on enable

1. 创建ISP域

domain 1x-domain

authentication lan-access radius-scheme 1x-test

authorization lan-access radius-scheme 1x-test

accounting lan-access radius-scheme 1x-test

access-limit disable

state active

idle-cut disable

1. 接口开启mac认证和802.1x认证

interface g0/0/1

port link-type hybrid

port hybrid vlan 100,110,120 untagged

port hybrid pvid vlan 10

mac-vlan enable

dot1x guest-vlan 100        //guest-vlan

dot1x auth-fail vlan 110    //认证失败vlan

dot1x critical vlan 120     //逃生vlan

port-security port-mode userlogin-secure-or-mac-ext   //先1x认证再mac认证

port-security port-mode mac-else-userlogin-secure-secure-ext     //先mac，认证失败后1x  一般接哑重点使用先mac后1x

macauthentication parallel-with-dot1x    //mac认证和1x认证并行处理

undo dot1x handshake

dot1x mandatory-domain 1x-domain

undo dot1x multicast-trigger

dot1x

dot1x unicast-trigger

//如果配置的先1x后mac认证，可以配置如下命令，让mac认证延时15~30秒

mac-authentication timer auth-delay 15  

//端口同时开启了MAC地址认证和802.1X认证的情况下，某些组网环境中希望设备对用户报文先进行802.1X认证。例如，有些客户端在发送802.1X认证请求报文之前，就已经向设备发送了其它报文，比如DHCP报文，因而触发了并不期望的MAC地址认证。这种情况下，可以开启端口的MAC地址认证延时功能。开启该功能后，端口就不会在收到用户报文时立即触发MAC地址认证，而是会等待一定的延迟时间，若在此期间该用户一直未进行802.1X认证或未成功通过802.1X认证，则延迟时间超时后端口会对之前收到的用户报文进行MAC地址认证。

这样可以较快获取dhcp ip地址 

1. COA配置（踢设备下线）

radius dynamic-author server

client ip 10.10.10.10 key simple 123456