221PrerequisitesBefore you configure the MAC authentication critical VLAN on a port, complete the following tasks:• Create the VLAN to be specified as the MAC authentication critical VLAN.• Configure the port as a hybrid port, and configure the VLAN as an untagged member on theport.For information about VLAN configuration, see Layer 2—LAN Switching Configuration Guide.ProcedureTo configure the MAC authentication critical VLAN on a port:Step Command Remarks1. Enter system view. system-view N/A2. Enter Ethernet interfaceview.interface interface-typeinterface-number N/A3. Specify the MACauthentication criticalVLAN on the port.mac-authentication critical vlancritical-vlan-idBy default, no MAC authenticationcritical VLAN exists.You can configure only one MACauthentication critical VLAN on aport.Configuring the keep-online featureBy default, the device logs off online MAC authentication users if no server is reachable for MACreauthentication. The keep-online feature keeps authenticated MAC authentication users onlinewhen no server is reachable for MAC reauthentication.In a fast-recovery network, you can use the keep-online feature to prevent MAC authentication usersfrom coming online and going offline frequently.To configure the keep-online feature:Step Command Remarks1. Enter system view. system-view N/A2. Enter Ethernet interface view. interface interface-typeinterface-number N/A3. Enable the keep-online featurefor authenticated MACauthentication users on theport.mac-authenticationre-authenticateserver-unreachable keep-onlineBy default, the keep-onlinefeature is disabled.This command takes effect onlywhen the authentication serverassigns reauthenticationattributes to the device.
