3Com WXR100 3CRWXR10095A, WX4400 3CRWX440095A manual Authentication, Authorization by, MAC Address

456CHAPTER 21: CONFIGURING AAA FOR NETWORK USERS

Configuring	You must sometimes authenticate users based on the MAC addresses of
Authentication and	their devices rather than a username-password or certificate. For
Authorization by	example, some Voice-over-IP (VoIP) phones and personal digital assistants
MAC Address	(PDAs) do not support 802.1X authentication. If a client does not support
	802.1X, MSS attempts to perform MAC authentication for the client
	instead. The WX switch can discover the MAC address of the device from
	received frames and can use the MAC address in place of a username for
	the client.
	Users authorized by MAC address require a MAC authorization password
	if RADIUS authentication is desired. By default, MSS assumes that the
	MAC address for a MAC user is also the password.
	CAUTION: Use this method with care. IEEE 802.11 frames can be forged
	and can result in unauthorized network access if MAC authentication is
	employed.
Adding and Clearing	MAC users and groups can gain network access only through the WX
MAC Users and User	switch. They cannot create administrative connections to the WX switch.
Groups Locally	A MAC user is created in a similar fashion to other local users except for
	having a MAC address instead of a username. MAC user groups are
	created in a similar fashion to other local user groups.
	(To create a MAC user profile or MAC user group on a RADIUS server, see
	the documentation for your RADIUS server.)
	Adding MAC Users and Groups
	To create a MAC user group in the local WX database, you must
	associate it with an authorization attribute and value. Use the following
	command:
	set mac-usergroupgroup-name attr attribute-name value
	For example, to create a MAC user group called mac-easterswith a
	3000-second Session-Timeout value, type the following command:
	WX1200# set mac-usergroup mac-easters attr
	session-timeout 3000
	success: change accepted.
	To configure a MAC user in the local database and optionally add the
	user to a group, use the following command:

set mac-user mac-addr[group group-name]