MAC认证提供了一种基于MAC的认证手段，并简单地通过MAC地址来实现认证，整个过程不需要输入任何信息。这种简化适用于无线局域网的接入认证、点对点物理或逻辑端口的接入认证，但在可运营、可管理的宽带IP城域网中作为一种认证方式具有极大的局限性。
本地MAC认证配置举例
1. 主要配置步骤
(1) 创建本地用户
[AC]local-user 000e35cb3650 [AC-luser-000e35cb3650]service-type lan-access [AC-luser-000e35cb3650]password simple 000e35cb3650 [AC-luser-000e35cb3650]quit
(2) 指定domain域
[AC]mac-authentication domain system
(3) 全局使能端口安全
[AC]port-security enable
(4) 在WLAN-ESS 50上使能MAC认证
[AC]interface WLAN-ESS 50 [AC-WLAN-ESS50]port-security port-mode mac-authentication
(5) 无线服务集设置
[AC]wlan service-template 50 clear [AC-wlan-st-50]ssid joe_mac [AC-wlan-st-50]bind WLAN-ESS 50 [AC-wlan-st-50]authentication-method open-system [AC-wlan-st-50]service-template enable
2. 配置信息
<AC>display current-configuration
#
version 5.00, 0001
#
sysname AC
#
ftp server enable
#
ipv6
#
port-security enable
#
mac-authentication domain system
#
vlan 1
#
vlan 2
#
radius scheme h3c
server-type extended
primary authentication 8.1.1.4
primary accounting 8.1.1.4
key authentication h3c
key accounting h3c
domain cams
authentication default radius-scheme h3c
authorization default radius-scheme h3c
accounting default radius-scheme h3c
access-limit disable
state active
idle-cut enable 90
domain system
access-limit disable
state active
idle-cut disable
self-service-url disable
#
dhcp server ip-pool 20
network 20.1.1.0 mask 255.255.255.0
gateway-list 20.1.1.126
#
local-user 000e35cb3650
password simple 000e35cb3650
service-type lan-access
#
wlan service-template 50 clear
ssid joe_mac
bind WLAN-ESS 50
authentication-method open-system
service-template enable
#
wlan rrm
11a mandatory-rate 6 12 24
11a supported-rate 9 18 36 48 54
11b mandatory-rate 1 2
11b supported-rate 5.5 11
11g mandatory-rate 1 2 5.5 11
11g supported-rate 6 9 12 18 24 36 48 54
#
interface NULL0
#
interface LoopBack0
#
interface Vlan-interface1
ip address 20.1.1.200 255.255.255.0
#
interface Vlan-interface2
ip address 8.1.1.1 255.255.255.0
#
interface GigabitEthernet1/0/1
#
interface GigabitEthernet1/0/2
port access vlan 2
#
interface M-Ethernet1/0/1
#
interface WLAN-ESS50
port-security port-mode mac-authentication
#
wlan ap ap1 model WA2100
serial-id h3c000fe258e820
radio 1 type 11g
channel 1
max-power 3
service-template 50
radio enable
#
dhcp enable
#
load xml-configuration
#
user-interface aux 0
idle-timeout 0 0
user-interface vty 0 4
authentication-mode scheme
user privilege level 3
set authentication password simple 123
#
return
远程认证的方式参考：
http://www.elvhome.com/html/2013-10-22/2013102211275899913.html