The dot1x domain command configures a forcible domain for 802.1X authentication users.
The undo dot1x domain command restores the default setting of a forcible domain for 802.1X authentication users.
By default, no forcible domain is configured for 802.1X authentication users.
Parameter |
Description |
Value |
|---|---|---|
domain-name |
Specifies the name of a forcible domain. |
The value must be an existing domain name on the device. |
Ethernet interface view, GE interface view, MultiGE interface view, XGE interface view, 25GE interface view, 40GE interface view, 100GE interface view, Eth-Trunk interface view, Port group view
Usage Scenario
During authentication, if the user name entered by a user does not contain a domain name, the user will be authenticated in the default domain; if the user name contains a domain name, the user will be authenticated in the specified domain.
If the user names entered by many users do not contain domain names, excess users are authenticated in the default domain, making the authentication scheme inflexible. If all users on an interface need to use the same AAA scheme when the user names entered by some users contain domain name and those entered by other users do not, the device also cannot meet such requirement. To address this issue, you can configure a forcible domain. Then all users on the interface will be authenticated in the forcible domain no matter whether the user names entered by the users contain domain names.
Prerequisites
A domain has been created using the domain command.
# Configure the forcible domain huawei for 802.1X authentication users on the interface GE0/0/1.
<HUAWEI> system-view [HUAWEI] aaa [HUAWEI-aaa] domain huawei [HUAWEI-aaa-domain-huawei] quit [HUAWEI-aaa] quit [HUAWEI] interface gigabitethernet0/0/1 [HUAWEI-GigabitEthernet0/0/1] dot1x domain huawei