216Prerequisites for MAC authenticationBefore you configure MAC authentication, configure an ISP domain and specify an AAA method. Formore information, see "Configuring AAA."• For local authentication, you must also create local user accounts (including usernames andpasswords) and specify the lan-access service for local users.• For RADIUS authentication, make sure the device and the RADIUS server can reach eachother and create user accounts on the RADIUS server. If you are using MAC-based accounts,make sure the username and password for each account are the same as the MAC address ofeach MAC authentication user.Enabling MAC authenticationFor MAC authentication to take effect on a port, you must enable this feature globally and on the port.To enable MAC authentication:Step Command Remarks1. Enter system view. system-view N/A2. Enable MAC authenticationglobally. mac-authentication By default, MAC authenticationis disabled globally.3. Enter interface view. interface interface-typeinterface-number N/A4. Enable MAC authentication onthe port. mac-authentication By default, MAC authenticationis disabled on a port.Specifying a MAC authentication domainBy default, MAC authentication users are in the system default authentication domain. To implementdifferent access policies for users, you can use one of the following methods to specifyauthentication domains for MAC authentication users:• Specify a global authentication domain in system view. This domain setting applies to all portsenabled with MAC authentication.• Specify an authentication domain for an individual port in interface view.MAC authentication chooses an authentication domain for users on a port in this order: theport-specific domain, the global domain, and the default domain. For more information aboutauthentication domains, see "Configuring AAA."To specify an authentication domain for MAC authentication users:Step Command Remarks1. Enter system view. system-view N/A
