In NAC network deployment, 802.1x authentication and MAC address authentication can be deployed on interfaces of access users to flexibly adapt to various authentication requirements. In this manner, users can access the network in any authentication mode.
After multiple authentication modes are deployed, the device allows users to access the network in different modes by default to grant different network rights to users.
In this example, MAC address authentication is performed. If the authentication fails, 802.1X authentication is performed.
Picture1-1 Two authentication networking modes
The unified mode is used.
Configuration file
#
authentication-profile name p1
dot1x-access-profile d1
mac-access-profile m1
authentication dot1x-mac-bypass // After MAC address bypass authentication is enabled in an authentication profile, the user who uses the authentication profile performs 802.1X authentication first. If the authentication fails, the device starts the MAC address authentication process for the user.
#
domain isp
#
radius-server template rd1
radius-server shared-key cipher %#%#FP@&C(&{$F2HTlPxg^NLS~KqA/\^3Fex;T@Q9A](%#%#
radius-server authentication 192.168.100.100 1812 weight 80
radius-server accounting 192.168.100.100 1813 weight 80
#
dot1x-access-profile name d1
#
mac-access-profile name m1
#
aaa
authentication-scheme abc
authentication-mode radius
accounting-scheme acco1
accounting-mode radius
accounting realtime 15
domain isp
authentication-scheme abc
accounting-scheme acco1
radius-server rd1
#
interface GigabitEthernet1/0/1
authentication-profile p1
#
.
