As shown in Figure 1, a large number of dumb terminals (Printers in this example) in a company that access the Internet through ge-1/1/1 of the PICA8 Switch (as the access device). To ensure network access security, the administrator employs MAB authentication on the Switch and AAA server, to control the network access rights of the Printers. The Switch allows the Printers to access resources on the Internet only when the MAB authentication is successfully passed.
Ensure that PICA8 Switch is properly connected to the AAA server. In this example, the switch uses the management port Eth0 to connect to the AAA server.
Configuration on the AAA Server
- Configure the Eth0 IP address of the switch to establish a connection to the switch.
- Configure the credentials for each printer on the AAA server.
- Configure the shared key.
- Configure other RADIUS attributes for MAB authentication.
Configuration on the Switch
- Configure the AAA server IP and shared key on the Switch.
- Enable MAB authentication on the Switch, to perform MAB authentication on terminals that cannot install the 802.1X client software.
- Configure the host mode to multiple on interface ge-1/1/1.
Figure 1. Networking Diagram for Configuring MAB Authentication
Step1 Configure the access port to trunk mode and enable MAB authentication mode.
Step2 Configure IP address of AAA server and the shared key.
Step3 Configure the NAS IP address to the IP address of Eth0 interface which is connected to the AAA server.
This command is used to set the nas-ip field in RADIUS access-request message. If you use the management interface eth0/eth1 to connect to the AAA server, the IP address of the management interface eth0/eth1 should be used for the NAS IP address configured here.
Step4 Configure the host mode for NAC authentication interface.
Step5 Commit the configuration.
Step6 Verify the configuration.
Run the run show dot1x interface to check the MAB authentication configurations. The command output (MAC-RADIUS = enable) shows that the MAB authentication has been enabled on the interface ge-1/1/1 and MAC address ae:11:01:39:1a:00 is successfully authenticated.