Including user IP addresses in MAC authentication requests
About the feature of including user IP addresses in MAC authentication requests
This feature enables the device to add user IP addresses to the MAC authentication requests that are sent to an IMC server.
Upon receiving an authentication request, the IMC server compares the user IP and MAC addresses in the request with its local IP-MAC mapping of the user. If a match is found, the IMC server verifies the user valid. If no match is found, the user fails the MAC authentication.
The IMC server selects the IP-MAC combination for a MAC authentication user to match in the following order:
The IP and MAC addresses in the IMC platform user account associated with the MAC authentication user.
The IP and MAC addresses that are included in the authentication request. If the server does not have an authenticated IP-MAC record for the user, it determines that the IP-MAC combination of the user is valid. The server will record the IP-MAC combination of the user. If the user IP address is changed at the next authentication, the user cannot pass authentication.
Restrictions and guidelines
This feature takes effect only on MAC authentication users that use static IP addresses. Users that obtain IP addresses through DHCP are not affected.
Do not configure this feature together with the MAC authentication guest VLAN or guest VSI on a port. Otherwise, users in the MAC authentication guest VLAN or guest VSI cannot perform a new round of authentication.
Procedure
Enter system view.
system-view
Enter interface view.
interface interface-type interface-number
Include user IP addresses in MAC authentication requests.
mac-authentication carry user-ip
By default, a MAC authentication request does not include the user IP address.