(Optional) Configuring the Function of Identifying Static Users Through IP Addresses

By default, the device identifies static users through MAC addresses. However, a terminal may have one MAC address and multiple IP addresses, for example, a firewall has multiple valid IP addresses that correspond to only one MAC address. The terminal goes online only after the multiple IP addresses pass authentication. If the device identifies terminals through MAC addresses, entry information about IP addresses that are authenticated later continuously overwrites entry information about IP addresses that are authenticated earlier. As a result, the terminal cannot go online. You can run the ip-static-user enable command to enable the function of identifying static users through IP addresses so that terminals with one MAC address and multiple IP addresses can go online.

This function is only supported by the S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S5732-H, S6730-H, S6730S-H, S6730-S, S6730S-S, S6720-HI, and S5720-HI.

• For a terminal with one MAC address and multiple IP addresses, you must configure the terminal as a static user and enable the function of identifying static users through IP addresses so that the terminal can pass authentication and go online. If ip-user is not specified when you configure static users, all static users are processed by assuming they have one MAC address and multiple IP addresses. To precisely identify and process static users with one MAC address and multiple IP addresses, specify ip-user when configuring these static users.
• The device does not support traffic statistics collection for a terminal with one MAC address and multiple IP addresses.

• Configure wired users before enabling this function.

• This function takes effect only for users who go online after it is configured. After the configuration on an interface is modified, online users on the interface go offline.

• The device supports this function only when the user access mode is multi-authen. For details on how to configure the user access mode, see authentication mode.
• Static users who are identified through IP addresses directly go offline after they fail to pass authentication, and are not kept in the pre-connection state.

• Static users identified through IP addresses do not support right control during Layer 2 forwarding.

• Static users identified through IP addresses support only IP address-based upstream authorization services (such as authorization UCL, isolation between Layer 3 groups, CAR, and priority for upstream traffic), and do not support downstream authorization services (such as CAR, re-marking action, dynamic authorization VLAN, and HQoS for downstream traffic).

• In the policy association scenario, if the control point mode is set to open using the authentication control-point open command, the device does not support the function of identifying static users through IP addresses.

• For a terminal with one MAC address and multiple IP addresses, only ARP packets can be used to trigger authentication. Therefore, ensure that the device can perform authentication triggered by ARP packets; for example, the types of packets that can trigger authentication must include ARP.
• For the S5720-HI, S5730-HI, S5731-H, S5731S-H, S5732-H, S5731-S, S5731S-S, S6720-HI, S6730-H, S6730S-H, S6730-S, and S6730S-S, when the ip-static-user enable and authentication trigger-condition any-l2-packet commands are both configured, user authentication cannot be triggered by any Layer 2 packets.

Pre-configuration Tasks