Example: Configuring port security in userLoginWithOUI mode

Network configuration

As shown in Figure 95, a client is connected to the device through HundredGigE 1/0/1. The device authenticates the client with a RADIUS server in ISP domain sun. If the authentication succeeds, the client is authorized to access the Internet.

Configure HundredGigE 1/0/1 to allow only one 802.1X user and a user that uses one of the specified OUI values to be authenticated.

Figure 95: Network diagram

Procedure

The following configuration steps cover some AAA/RADIUS configuration commands. For more information about the commands, see Security Command Reference.

Make sure the host and the RADIUS server can reach each other.

  1. Configure AAA:

    # Configure a RADIUS scheme named radsun.

    <Device> system-view
    [Device] radius scheme radsun
    [Device-radius-radsun] primary authentication 192.168.1.2
    [Device-radius-radsun] primary accounting 192.168.1.3
    [Device-radius-radsun] secondary authentication 192.168.1.3
    [Device-radius-radsun] secondary accounting 192.168.1.2
    [Device-radius-radsun] key authentication simple name
    [Device-radius-radsun] key accounting simple money
    [Device-radius-radsun] timer response-timeout 5
    [Device-radius-radsun] retry 5
    [Device-radius-radsun] timer realtime-accounting 15
    [Device-radius-radsun] user-name-format without-domain
    [Device-radius-radsun] quit
    

    # Configure ISP domain sun.

    [Device] domain sun
    [Device-isp-sun] authentication lan-access radius-scheme radsun
    [Device-isp-sun] authorization lan-access radius-scheme radsun
    [Device-isp-sun] accounting lan-access radius-scheme radsun
    [Device-isp-sun] quit
    
  2. Configure 802.1X:

    # Set the 802.1X authentication method to CHAP. By default, the authentication method for 802.1X is CHAP.

    [Device] dot1x authentication-method chap
    

    # Specify ISP domain sun as the mandatory authentication domain for 802.1X users on HundredGigE 1/0/1.

    [Device] interface hundredgige 1/0/1
    [Device-HundredGigE1/0/1] dot1x mandatory-domain sun
    [Device-HundredGigE1/0/1] quit
    
  3. Configure port security:

    # Enable port security.

    [Device] port-security enable
    

    # Add five OUI values. (You can add up to 16 OUI values. The port permits only one user matching one of the OUIs to pass authentication.)

    [Device] port-security oui index 1 mac-address 1234-0100-1111
    [Device] port-security oui index 2 mac-address 1234-0200-1111
    [Device] port-security oui index 3 mac-address 1234-0300-1111
    [Device] port-security oui index 4 mac-address 1234-0400-1111
    [Device] port-security oui index 5 mac-address 1234-0500-1111
    

    # Set the port security mode to userLoginWithOUI.

    [Device] interface hundredgige 1/0/1
    [Device-HundredGigE1/0/1] port-security port-mode userlogin-withoui
    [Device-HundredGigE1/0/1] quit
    

Verifying the configuration

# Verify that HundredGigE 1/0/1 allows only one 802.1X user to be authenticated.

[Device] display port-security interface hundredgige 1/0/1
Global port security parameters:
   Port security          : Enabled
   AutoLearn aging time   : 30 min
   Disableport timeout    : 30 s
   MAC move               : Denied
   Authorization fail     : Online
   NAS-ID profile         : Not configured
   Dot1x-failure trap     : Disabled
   Dot1x-logon trap       : Disabled
   Dot1x-logoff trap      : Disabled
   Intrusion trap         : Disabled
   Address-learned trap   : Disabled
   Mac-auth-failure trap  : Disabled
   Mac-auth-logon trap    : Disabled
   Mac-auth-logoff trap   : Disabled
   Open authentication    : Disabled
   OUI value list         :
       Index :  1       Value : 123401
       Index :  2       Value : 123402
       Index :  3       Value : 123403
       Index :  4       Value : 123404
       Index :  5       Value : 123405

 HundredGigE1/0/1 is link-up
   Port mode                      : userLoginWithOUI
   NeedToKnow mode                : Disabled
   Intrusion protection mode      : NoAction
Security MAC address attribute 
       Learning mode              : Sticky
       Aging type                 : Periodical
   Max secure MAC addresses       : Not configured
   Current secure MAC addresses   : 1
   Authorization                  :Permitted
   NAS-ID profile                 : Not configured
   Free VLANs                     : Not configured
   Open authentication            : Disabled

# Display information about the online 802.1X user to verify 802.1X configuration.

[Device] display dot1x

# Verify that the port also allows one user whose MAC address has an OUI among the specified OUIs to pass authentication.

[Device] display mac-address interface hundredgige 1/0/1
MAC Address     VLAN ID   State          Port/NickName            Aging
1234-0300-0011  1         Learned        HGE1/0/1                 Y