1-2to the RADIUS server as the user names and uses the configured fixed password asthe password.z In fixed mode, the switch sends the user name and password previously configured forthe user to the RADIUS server for authentication.The RADIUS authentication process is the same as that of the 802.1x PAP authenticationmethod. For details, refer to 802.1x and System-Guard Operation.A user can access a network upon passing the authentication performed by the RADIUSserver.Performing MAC Address Authentication LocallyWhen authentications are performed locally, users are authenticated by switches. In thiscase,z In MAC address mode, the local user name to be configured is the MAC address of anaccess user, while the password may be the MAC address of the user or the fixedpassword configured (which is used depends on your configuration). Hyphens must ormust not be included depending on the format configured with the mac-authenticationauthmode usernameasmacaddress usernameformat command; otherwise, theauthentication will fail.z In fixed mode, all users’ MAC addresses are automatically mapped to the configuredlocal passwords and usernames.z The service type of a local user needs to be configured as lan-access.Related ConceptsMAC Address Authentication TimersThe following timers function in the process of MAC address authentication:z Offline detect timer: At this interval, the switch checks to see whether an online userhas gone offline. Once detecting that a user becomes offline, the switch sends astop-accounting notice to the RADIUS server.z Quiet timer: Whenever a user fails MAC address authentication, the switch does notinitiate any MAC address authentication of the user during a period defined by thistimer.z Server timeout timer: During authentication of a user, if the switch receives noresponse from the RADIUS server in this period, it assumes that its connection to theRADIUS server has timed out and forbids the user from accessing the network.Quiet MAC AddressWhen a user fails MAC address authentication, the MAC address becomes a quiet MACaddress, which means that any packets from the MAC address will be discarded simply bythe switch until the quiet timer expires. This prevents an invalid user from beingauthenticated repeatedly in a short time.
