mac-authen username

Function

The mac-authen username command configures the user name for MAC address authentication.

The undo mac-authen username command restores the default setting.

By default, the MAC address without hyphens (-) or colons (:) is used as the user name and password for MAC address authentication.

Format

mac-authen username { fixed username [ password cipher password ] | macaddress [ format { with-hyphen [ normal ] [ colon ] | without-hyphen } [ uppercase ] [ password cipher password ] ] | dhcp-option option-code { circuit-id | remote-id } ^* [ separate separate ] [ format-hex ] password cipher password }

undo mac-authen username [ fixed username [ password cipher password ] | macaddress [ format { with-hyphen [ normal ] [ colon ] | without-hyphen } [ uppercase ] [ password cipher password ] ] | dhcp-option option-code [ circuit-id | remote-id ] ^* [ password cipher password ] ]

Parameters

Parameter	Description	Value
fixed username	Specifies a fixed user name for MAC address authentication.	The value is a string of 1 to 64 case-sensitive characters without spaces. When double quotation marks are used around the string, spaces are allowed in the string.
password cipher password	Specifies the password in cipher text for MAC address authentication. You do not need to set a password for a fixed user name if the authentication mode is none. In this case, the user can log in without a password. However, this poses security risks and is not recommended. If no password is set when the MAC address is used as the user name, the user can log in using the MAC address as the password. A password must be configured when local authentication is used in the AAA scheme. The password must be configured when the user name for MAC address authentication is in the DHCP option format.	The value is a string of case-sensitive characters without spaces. The password is either a plain-text string of 1 to 128 characters or a cipher-text string of 48 to 188 characters. When double quotation marks are used around the string, spaces are allowed in the string. NOTE: For security purposes, change the default password in real time. The new password must be a combination of at least two of the following: digits, lowercase letters, uppercase letters, and special characters. In addition, the password must consist of six or more than six characters.
macaddress	Specifies the MAC address as the user name for MAC address authentication.	-
format { with-hyphen [ normal ] [ colon ] \| without-hyphen }	Specifies the MAC address format. with-hyphen: indicates that the MAC address contains hyphens (-), for example, 0005-e01c-02e3. with-hyphen normal: indicates that the MAC address contains hyphens (-), for example, 00-05-e0-1c-02-e3. with-hyphen colon: indicates that the MAC address contains colons (:), for example, 0005:e01c:02e3. with-hyphen normal colon: indicates that the MAC address contains colons (:), for example, 00:05:e0:1c:02:e3. without-hyphen: indicates that the MAC address does not contain hyphens (-) or colons (:), for example, 0005e01c02e3.	-
uppercase	Indicates that the name of a MAC address authentication user is in uppercase.	-
dhcp-option option-code	Specifies the name of the MAC address authentication user to a specified DHCP option. circuit-id: Specifies the circuit ID in the DHCP Option82 field as the user name in MAC address authentication. remote-id: Specifies the remote ID in the DHCP Option82 field as the user name in MAC address authentication. If both circuit-id and remote-id are configured, the user name for MAC address authentication can be set to a character string that is a combination of the circuit-id and remote-id in the DHCP Option82 field.	The value is an integer. In the current version, the value is fixed as 82.
separate separate	Specifies the delimiter in the user name for MAC address authentication. This parameter is configured when the user name for MAC address authentication is set to a character string that is a combination of the circuit-id and remote-id in the DHCP Option82 field.	The value is a character and can be set to a letter, digit, or another valid character.
format-hex	Indicates that the user name for MAC address authentication is in hexadecimal format.	-

Views

MAC access profile view

Default Level

2: Configuration level

Usage Guidelines

Usage Scenario

The following user name formats are available for MAC address authentication:

Fixed user name: A user uses the fixed user name and password configured by the administrator for authentication.
MAC address: A user uses the MAC address as the user name for authentication. In addition, the MAC address or user-defined character string can be used as the password.
When the DHCP option format is used for MAC address authentication, the device uses the DHCP option it obtains and password set by the administrator for authentication. In this mode, ensure that the device supports MAC address authentication triggered through DHCP packets.

By default, the device sends the user MAC address as the user name and password to the authentication server for authentication. However, the users cannot be easily identified and managed in this case. To flexibly identify and manage users, run the mac-authen username command to configure fixed user names and passwords for MAC address authentication users.

Precautions

When configuring the user name format for MAC address authentication, ensure that the authentication server supports the user name format.
If MAC address authentication is enabled on a VLANIF interface, on an Eth-Trunk, in a port group, or in a VAP profile, and MAC address authentication users use fixed user names, passwords must be configured. If MAC address authentication is enabled in a port group and MAC addresses are used as user names, passwords cannot be configured. If MAC address authentication is enabled on a VLANIF interface or in a VAP profile, user names for MAC address authentication cannot be set to specified DHCP option information.

Example

# In the MAC access profile mac_access_profile, configure the device to use the MAC address containing hyphens (-) as the user name.

<HUAWEI> system-view
[HUAWEI] mac-access-profile name mac_access_profile
[HUAWEI-mac-access-profile-mac_access_profile] mac-authen username macaddress format with-hyphen