Configuring Static Users

Context

In network deployment, static IP addresses are assigned to dumb terminals such as printers and servers. These users can be configured as static users for flexible authentication.

After static users are configured, the device can use static user information such as their IP addresses as the user names to authenticate the users only if one of the 802.1X authentication, MAC address authentication, and Portal authentication modes is enabled on the interfaces connected to the static users.

After static users are configured, the device first uses the static user names and passwords to authenticate the users. If the authentication fails, the device can perform 802.1X authentication, MAC address authentication, or Portal authentication on the users.

If the IP address of a user who passes 802.1X, MAC address, or Portal authentication is modified to a static IP address, the device changes the user state to pre-connection when detecting the user IP address change (for example, when the user accesses network resources). After the re-authentication period for the pre-connection state expires, the user can be re-authenticated for connection.

If a user's IP address is not within the IP address range of static users, the device changes the user state to pre-connection during authentication. If the user changes the IP address to a static user's IP address, the user cannot be successfully authenticated immediately. After the re-authentication period for the pre-connection state expires, the user can be re-authenticated and go online. If the user needs to go online immediately, the administrator can run the cut access-user command to force the user to go offline. The user then can be successfully authenticated immediately.

After the static user authentication succeeds, re-authentication is not supported.

Procedure

Run system-view
The system view is displayed.
Run static-user start-ip-address [ end-ip-address ] [ vpn-instance vpn-instance-name ] [ ip-user ] [ domain-name domain-name | interface interface-type interface-number [ detect ] | mac-address mac-address | vlan vlan-id | keep-online ] ^*
The static user is configured.

By default, no static user is configured.

When the interface (interface interface-type interface-number) mapping static users is specified, the VLAN (vlan vlan-id) to which the interface belongs must be configured.
Run static-user username macaddress format { with-hyphen [ normal ] [ colon ] | without-hyphen } [ uppercase ] [ password-with-macaddress ]
The user name for authenticating a static user is set to a MAC address.

By default, the user name for authenticating a static user is not set to a MAC address.

This command takes priority over the static-user username format-include { ip-address | mac-address | system-name } command and static-user password cipher password command.
Run static-user username format-include { ip-address | mac-address | system-name }
The static user name for authentication is set.

By default, the name of a static user consists of system-name and ip-address. For example, if the access device name is huawei and user IP address is 1.1.1.1, the static user name is huawei1.1.1.1.
Run static-user password cipher password
The static user password for authentication is set.

By default, the password for a static user in authentication not set.
(Optional) Run static-user not-update-ip enable
The device is disabled from updating IP addresses of static users.

By default, the device cannot update IP addresses of static users.