Huawei AR1200-S User Manual

Context
If 802.1x authentication is disabled on an interface, running the dot1x mac-bypass command
also enables 802.1x authentication.
If 802.1x authentication has been enabled on an interface, after the dot1x mac-bypass command
is executed, the latest configuration overrides the previous one.
MAC address bypass authentication can be configured in the system view and interface view.
Procedure
l Enabling MAC address bypass authentication in the system view
1. Run:
system-view
The system view is displayed.
2. Run:
dot1x mac-bypass interface { interface-type interface-number1 [ to
interface-number2 ] } &<1-10>
MAC address bypass authentication is enabled on an interface.
By default, MAC address bypass authentication is disabled on an interface.
l Enabling MAC address bypass authentication in the interface view
1. Run:
system-view
The system view is displayed.
2. Run:
interface interface-type interface-number
The interface view is displayed.
3. Run:
dot1x mac-bypass
MAC address bypass authentication is enabled on the interface.
By default, MAC address bypass authentication is disabled on an interface.
----End
5.3.5 (Optional) Setting the 802.1x Authentication Mode
The AR1200-S supports CHAP authentication, PAP authentication, and EAP relay
authentication.
Context
PAP is a two-way handshake authentication protocol and transmits passwords in plain text. It
has low security.
CHAP is a three-way handshake authentication protocol and transmits passwords in cipher text.
It has higher security than PAP.
EAP supports multiple authentication mechanisms. The AR1200-S transparently transmits EAP
Request packets and Response packets to the authentication server. The AR1200-S determines
Huawei AR1200-S Series Enterprise Routers
Configuration Guide - Security 5 NAC Configuration
Issue 02 (2012-03-30) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
102

Huawei AR1200-S Specifications

General

Brand	Huawei
Model	AR1200-S
Category	Network Router
Language	English