Configuration procedure

The following configuration procedure covers most AAA/RADIUS configuration commands on the device. The configuration on the 802.1X client and RADIUS server are not shown. For more information about AAA/RADIUS configuration commands, see Security Command Reference.

  • Make sure the 802.1X client can update its IP address after the access port is assigned to the guest VLAN or a server-assigned VLAN. (Details not shown.)

  • Configure the RADIUS server to provide authentication, authorization, and accounting services. Configure user accounts and server-assigned VLAN, VLAN 5 in this example. (Details not shown.)

  • Create VLANs, and assign ports to the VLANs.

  • <Device> system-view
    [Device] vlan 1
    [Device-vlan1] port ethernet 1/0/2
    [Device-vlan1] quit
    [Device] vlan 10
    [Device-vlan10] port ethernet 1/0/1
    [Device-vlan10] quit
    [Device] vlan 2
    [Device-vlan2] port ethernet 1/0/4
    [Device-vlan2] quit
    [Device] vlan 5
    [Device-vlan5] port ethernet 1/0/3
    [Device-vlan5] quit
    
  • Configure a RADIUS scheme:

  • # Configure RADIUS scheme 2000 and enter its view.

    <Device> system-view
    [Device] radius scheme 2000
    

    # Specify primary and secondary authentication and accounting servers. Set the shared key to abc for authentication and accounting packets.

    [Device-radius-2000] primary authentication 10.11.1.1 1812
    [Device-radius-2000] primary accounting 10.11.1.1 1813
    [Device-radius-2000] key authentication abc
    [Device-radius-2000] key accounting abc
    

    # Exclude the ISP domain name from the username sent to the RADIUS server.

    [Device-radius-2000] user-name-format without-domain
    [Device-radius-2000] quit
    
  • Configure an ISP domain:

  • # Create ISP domain bbb and enter its view.

    [Device] domaim bbb
    

    # Apply RADIUS scheme 2000 to the ISP domain for authentication, authorization, and accounting.

    [Device-isp-bbb] authentication lan-access radius-scheme 2000
    [Device-isp-bbb] authorization lan-access radius-scheme 2000
    [Device-isp-bbb] accounting lan-access radius-scheme 2000
    [Device-isp-bbb] quit
    
  • Configure 802.1X:

  • # Enable 802.1X globally.

    [Device] dot1x
    

    # Enable 802.1X for port Ethernet 1/0/2.

    [Device] interface ethernet 1/0/2
    [Device-Ethernet1/0/2] dot1x
    

    # Implement port-based access control on the port.

    [Device-Ethernet1/0/2] dot1x port-method portbased
    

    # Set the port authorization mode to auto. This step is optional. By default, the port is in auto mode.

    [Device-Ethernet1/0/2] dot1x port-control auto
    [Device-Ethernet1/0/2] quit
    

    # Set VLAN 10 as the 802.1X guest VLAN for port Ethernet 1/0/2.

    [Device] dot1x guest-vlan 10 interface ethernet 1/0/2