3Com 3CRWX440095A, 3CRWX120695A manual AAA Commands

200CHAPTER 7: AAA COMMANDS

Defaults — By default, authentication is deactivated for all MAC users, which means MAC address authentication fails by default. When using RADIUS for authentication, a MAC user’s MAC address is also used as the authorization password for that user, and no global authorization password is set.

Access — Enabled.

History —Introduced in MSS Version 3.0.

Usage — You can configure different authentication methods for different groups of MAC addresses by “globbing.” (For details, see “User Globs, MAC Address Globs, and VLAN Globs” on page 24.)

If you specify multiple authentication methods in the set authentication mac command, MSS applies them in the order in which they appear in the command, with these results:

If the first method responds with pass or fail, the evaluation is final.

If the first method does not respond, MSS tries the second method, and so on.

However, if local appears first, followed by a RADIUS server group, MSS ignores any failed searches in the local WX database and sends an authentication request to the RADIUS server group.

If the switch’s configuration contains a set authentication mac command that matches the SSID the user is attempting to access and the user’s MAC address, MSS uses the method specified by the command. Otherwise, MSS uses local MAC authentication by default.

If the username does not match an authentication rule for the SSID the user is attempting to access, MSS uses the fallthru authentication type configured for the SSID, which can be last-resort, web (for WebAAA), or none.

Examples — To use the local WX database to authenticate all users who access the mycorp2 SSID by their MAC address, type the following command:

WX4400# set authentication ssid mycorp2 mac ** local success: change accepted.