实验环境：
三个VLAN环境，VLAN 10 与VLAN 20 分别用于测试，VLAN 30 为服务器所在VLAN（DHCP服务器 一台，ACS服务器一台（radius）；
DHCP服务器基于centos系统；
ACS服务器基于windows server 2003 系统；
实验拓扑如下：
DHCP服务器的具体配置内容：
server 2003 上ACS的配置步骤：
因为ACS客户端是基于Java编写的，所以要先确定你的系统上具有支持Java的环境；可以安装jdk等软件
ACS安装：
服务器端的配置步骤;
还要添加用于账号验证的账户，并配置口令：
设备的具体配置:
System View: return to User View with Ctrl+Z.
[Quidway]sysname sw1
[sw1]vlan 10
[sw1-vlan10]port e1/0/10
[sw1-vlan10]vlan 20
[sw1-vlan20]port e1/0/20
[sw1-vlan20]vlan 30
[sw1-vlan30]port e1/0/24
[sw1-vlan30]q
[sw1]int Vlan-interface 1
[sw1-Vlan-interface1]
[sw1-Vlan-interface1]ip add 192.168.3.2 24
[sw1-Vlan-interface1]q
[sw1]int e1/0/1
[sw1-Ethernet1/0/1]port link-type trunk
[sw1-Ethernet1/0/1]port trunk permit vlan all
Please wait........................................... Done.
[sw1-Ethernet1/0/1]q
[sw1]ip route-static 0.0.0.0 0.0.0.0 192.168.3.1
[sw1]
[sw1]
System View: return to User View with Ctrl+Z.
[H3C]sysname firewall
[firewall]int eth0/0.1
[firewall-Ethernet0/0.1]ip add 192.168.10.1 24
[firewall-Ethernet0/0.1]vlan-type dot1q vid 10
[firewall-Ethernet0/0.1]int eth0/0.2
[firewall-Ethernet0/0.2]vlan-type dot1q vid 20
[firewall-Ethernet0/0.2]ip add
[firewall-Ethernet0/0.2]ip address 192.168.20.1 24
[firewall-Ethernet0/0.2]int eth0/0.3
[firewall-Ethernet0/0.3]vlan-type dot1q vid 30
[firewall-Ethernet0/0.3]ip address 192.168.1.1 24
[firewall-Ethernet0/0.3]q
[firewall]int eth0/0
[firewall-Ethernet0/0]ip add 192.168.3.1 24
[firewall-Ethernet0/0]q
[firewall]firewall zone trust
[firewall-zone-trust]
[firewall-zone-trust]add int eth0/0.1
[firewall-zone-trust]add int eth0/0.2
[firewall-zone-trust]add int eth0/0.3
[firewall-zone-trust]q
[firewall]undo insulate
[firewall]
[firewall]dhcp ?
enable DHCP service enable
relay DHCP relay
select Specify process mode of DHCP packet
server DHCP server
[firewall]dhcp enable
DHCP task has already been started!
[firewall]dhcp select ?
global Global dhcp ip pool mode
interface Interface dhcp ip pool mode
relay Relay mode
[firewall]dhcp select relay interface eth0/0.1 to eth0/0.2
[firewall]int eth0/0.1
[firewall-Ethernet0/0.1]ip relay add 192.168.1.188
[firewall-Ethernet0/0.1]q
[firewall]int eth0/0.2
[firewall-Ethernet0/0.2]ip relay add 192.168.1.188
[firewall-Ethernet0/0.2]q
注意DHCP的配置步骤，不要忘了中继目标，这一点错了几次。。。
[firewall]radius ? 在此视图下怎加一个radius方案
client Radius Client config
nas-ip Specify RADIUS source ip address
scheme Add RADIUS scheme or modify radius-scheme attributes
trap Specify trap configuration
[firewall]radius scheme qw 并且指定方案的具体内容
[firewall-radius-qw]?
Radius-template view commands:
accounting Specify accounting mode
data-flow-format Specify data flow format
display Display current system information
key Specify the shared encryption key of RADIUS server
nas-ip Specify RADIUS source ip address
nslookup Query Internet name servers
ping Ping function
primary Specify IP address of primary RADIUS server
quit Exit from current command view
retry Specify retransmission times
return Exit to User View
save Save current configuration
secondary Specify IP address of secondary RADIUS server
security-policy-server Specify security policy server's IP address
server-type Specify the type of RADIUS server
state Specify state of primary/secondary
authentication/accounting RADIUS server
stop-accounting-buffer Enable stop-accounting packet buffer
timer Specify timer parameters
tracert Trace route function
undo Cancel current setting
user-name-format Specify user-name format sent to RADIUS server
vrbd Show application version
[firewall-radius-qw]primary authentication 192.168.1.2
[firewall-radius-qw]server-type standard
[firewall-radius-qw]user-name-format without-domain
[firewall-radius-qw]accounting optional
[firewall-radius-qw]key authentication 123456
[firewall-radius-qw]q
[firewall] 并且还要在防火墙和交换机山新建一个域，并在此域应用刚才建立的radius方案
[firewall]domain 123.com
New Domain added.
[firewall-isp-123.com]radius-scheme qw
[firewall-isp-123.com]access-limit enable 20
[firewall-isp-123.com]accounting optional
[firewall-isp-123.com]q
[firewall]
接下来是二层交换机上启用dot1x验证，并在端口开启，同样也要制定radius方案，并在端口应用
System View: return to User View with Ctrl+Z.
[sw1]dot1x
802.1X is enabled globally.
[sw1]int e1/0/10
[sw1-Ethernet1/0/10]dot1x
802.1X is enabled on port Ethernet1/0/10.
[sw1-Ethernet1/0/10]int e1/0/20
[sw1-Ethernet1/0/20]dot1x
802.1X is enabled on port Ethernet1/0/20.
[sw1-Ethernet1/0/20]q 并且要选择验证类型
[sw1]dot1x authentication-method pap
PAP authentication is enabled.
[sw1]radius scheme qw
New Radius scheme 方案内容如下，与防火墙类似
[sw1-radius-qw]primary authentication 192.168.1.2
[sw1-radius-qw]server-type standard
[sw1-radius-qw]accounting optional
[sw1-radius-qw]user-name-format without-domain
[sw1-radius-qw]key authentication 123456
[sw1-radius-qw]q
[sw1]domain acs.com
New Domain added.
[sw1-isp-acs.com]radius-scheme qw
[sw1-isp-acs.com]accounting op
[sw1-isp-acs.com]accounting optional
[sw1-isp-acs.com]q
这时我们的网络环境（radius）已经基本搭建完毕，已经可以进行认证并在服务器查看到有关的认证信息，如图，
我们在VLAN 10的相应端口进行测试，利用（此时因为我们的客户端（交换机，防火墙）华为的认证软件，进行账号认证测试（利用思科软件作为服务端，华为为客户端是可以的。因为我们客户端机器的验证类型为standard），
查看主机的具体地址信息：
然后是 VLAN 20 的主机：
然后从我们的的ACS服务器的相关日志页面可以看到我们刚才的登录信息，以构成完整的3A方案
设置telnet的有关属性
如果此时我们直接登录的话会出现如下界面，他表示登录是被允许的，但要验证口令，而口令没有被设置，所以直接被退了出来，
而这只是口令验证，并不是我们要实现的身份验证，口令验证是在用户接口模式下直接配置的，可以直接指定验证的类型，none ，password，或shcme，当我们配置完用户后，即使能登录，权限也是很受限制的，如图：
这时，我们有两种解决方案，一是在交换上配置超级用户密码，用于终端的身份切换，如图：
二是通过配置3A服务器端账户的私有属性（华为）来实现，我们要实现的是在radius服务器上的身份验证，所以我们要在交换机山做如下操作
[sw1]user-interface vty 0 4
[sw1-ui-vty0-4]authentication-mode ?
none Login without checking
password Use terminal interface password
scheme Use RADIUS scheme
[sw1-ui-vty0-4]authentication-mode scheme
[sw1]super ?
password Specify password
[sw1]super password level 3 cipher 123456
这时候我们要将防火墙和交换机的服务器类型应该为扩展型或华为私有型
System View: return to User View with Ctrl+Z.
[firewall]radius scheme qw
[firewall-radius-qw]ser
[firewall-radius-qw]server-type ?
extended Server based on RADIUS extensions
standard Server based on RFC protocol(s)
[firewall-radius-qw]server-type extended
[firewall-radius-qw]q
[firewall]
[sw1]radius sc
[sw1]radius scheme qw
[sw1-radius-qw]server-type ex
[sw1-radius-qw]server-type ?
huawei Server based on HUAWEI RADIUS extensions
standard Server based on RFC protocol(s)
[sw1-radius-qw]server-type hua
[sw1-radius-qw]server-type huawei
Such scheme is used by online user or stop-accounting buffer is not empty, can not be modified
注意此时如果设备上证在有用户使用，那么修改服务类型是不允许的所以，在用户退出后我们进行修改
[sw1-radius-qw]
%Apr 2 01:51:14:485 2000 sw1 SHELL/5/LOGOUT:- 1 - [email protected](192.168.20.2) in unit1 logout
[sw1-radius-qw]server-type huawei
[sw1-radius-qw]dis radius sch
[sw1-radius-qw]dis radius scheme
------------------------------------------------------------------
SchemeName =system Index=0 Type=huawei
Primary Auth IP =127.0.0.1 Port=1645
Primary Acct IP =127.0.0.1 Port=1646
Second Auth IP =0.0.0.0 Port=1812
Second Acct IP =0.0.0.0 Port=1813
Auth Server Encryption Key= Not configured
Acct Server Encryption Key= Not configured
Accounting method = required
Accounting-On packet disable, send times = 15 , interval = 3s
TimeOutValue(in second)=3 RetryTimes=3 RealtimeACCT(in minute)=12
Permitted send realtime PKT failed counts =5
Retry sending times of noresponse acct-stop-PKT =500
Quiet-interval(min) =5
Username format =without-domain
Data flow unit =Byte
Packet unit =1
unit 1 :
Primary Auth State=active, Second Auth State=block
Primary Acc State=active, Second Acc State=block
------------------------------------------------------------------
SchemeName =qw Index=1 Type=huawei
Primary Auth IP =192.168.1.2 Port=1812
Primary Acct IP =0.0.0.0 Port=1813
Second Auth IP =0.0.0.0 Port=1812
Second Acct IP =0.0.0.0 Port=1813
Auth Server Encryption Key= 123456
Acct Server Encryption Key= Not configured
Accounting method = optional
Accounting-On packet disable, send times = 15 , interval = 3s
TimeOutValue(in second)=3 RetryTimes=3 RealtimeACCT(in minute)=12
Permitted send realtime PKT failed counts =5
Retry sending times of noresponse acct-stop-PKT =500
Quiet-interval(min) =5
Username format =without-domain
Data flow unit =Byte
Packet unit =1
unit 1 :
Primary Auth State=active, Second Auth State=block
Primary Acc State=block , Second Acc State=block
------------------------------------------------------------------
Total 2 RADIUS scheme(s). 2 listed
[sw1-radius-qw]
全局配置后
<firewall>dis cu
#
sysname firewall
#
firewall packet-filter enable
firewall packet-filter default permit
#
undo insulate
#
firewall statistic system enable
#
radius scheme system
server-type extended
radius scheme qw
server-type extended
primary authentication 192.168.1.2
accounting optional
key authentication 123456
user-name-format without-domain
#
domain 123.com
scheme radius-scheme qw
access-limit enable 20
accounting optional
domain system
#
local-user admin
password cipher .]@USE=B,53Q=^Q`MAF4<1!!
service-type telnet terminal
level 3
service-type ftp
#
interface Ethernet0/0
ip address 192.168.3.1 255.255.255.0
#
interface Ethernet0/0.1
ip address 192.168.10.1 255.255.255.0
ip relay address 192.168.1.188
dhcp select relay
vlan-type dot1q vid 10
#
interface Ethernet0/0.2
ip address 192.168.20.1 255.255.255.0
ip relay address 192.168.1.188
dhcp select relay
vlan-type dot1q vid 20
#
interface Ethernet0/0.3
ip address 192.168.1.1 255.255.255.0
vlan-type dot1q vid 30
#
#
firewall zone trust
add interface Ethernet0/0
add interface Ethernet0/0.1
add interface Ethernet0/0.2
add interface Ethernet0/0.3
set priority 85
#
ip route-static 0.0.0.0 0.0.0.0 192.168.3.2 preference 60
#
user-interface con 0
user-interface aux 0
user-interface vty 0 4
authentication-mode scheme
#
return
#
sysname sw1
#
super password level 3 cipher OUM!K%F<+$[Q=^Q`MAF4<1!!
#
dot1x
dot1x authentication-method pap
#
radius scheme system
radius scheme qw
server-type huawei
primary authentication 192.168.1.2
accounting optional
key authentication 123456
user-name-format without-domain
#
domain acs.com
scheme radius-scheme qw
access-limit enable 20
accounting optional
domain system
#
vlan 1
#
vlan 10
#
vlan 20
#
vlan 30
#
interface Vlan-interface1
ip address 192.168.3.2 255.255.255.0
#
interface Aux1/0/0
#
interface Ethernet1/0/1
port link-type trunk
port trunk permit vlan all
interface Ethernet1/0/10
port access vlan 10
dot1x
interface Ethernet1/0/15
port access vlan 10
#
interface Ethernet1/0/20
port access vlan 20
dot1x
#
interface Ethernet1/0/24
port access vlan 30
#
interface NULL0
#
ip route-static 0.0.0.0 0.0.0.0 192.168.3.1 preference 60
#
user-interface aux 0
user-interface vty 0 4
authentication-mode scheme
#
return
服务器的配置如图所示：（服务器中添加华为私有属性）
将华为的属性文件复制到如下图所示的命令下并在dos命令下执行GCSutl命令，
然后我们新建一个用户并把它分到其它的组中去，并配置验证信息：
还有用户的登录方式一定要勾选
而且要把我们的客户端的相关属性改为华为的私有型并定义级别为“管理员”
结果如下：
分别用VLAN 10 和VLAN 20 的主机进行测试，
<二>应用MAC地址绑定验证：
具体配置步骤：
[sw1]mac-authentication
MAC-authentication is enabled globally.
[sw1]mac-authentication authmode usernameasmacaddress usernameformat without-hyphen
[sw1]int e1/0/20
[sw1-Ethernet1/0/20]mac-authentication
MAC-authentication is enabled on port Ethernet1/0/20
[sw1-Ethernet1/0/20]int e1/0/10
[sw1-Ethernet1/0/10]mac-authentication
MAC-authentication is enabled on port Ethernet1/0/10
[sw1-Ethernet1/0/10]quit
[sw1]dis mac-authentication int e1/0/20
Ethernet1/0/20 is link-up
MAC address authentication is Enabled
Authenticate success: 1, failed: 0
Current online user number is 1
