H3C交换机 802.1X+AD+CA+IAS进行802.1x身份验证

网络拓扑:

dis cu
#
 sysname layer_2_3
#
 domain default enable autonavi.com       //使能自己建立的域
#
 loopback-detection enable
#
 gvrp
#
 dot1x      //全局启用802.1x
 dot1x authentication-method eap     //使用EAP验证方式
#
radius scheme system
radius scheme test                        //建立test 
 server-type standard
 primary authentication 192.168.0.2   //指定主验证服务器，还可以指定辅验证服务器

 accounting optional                           //计费可选项，注意，当没有计费服务器，必须加上这条命令，否则无法验证通过
 key authentication test                    //验证密码：test
#
domain test.com                              //建立域test.com
 scheme radius-scheme test             //使用上面建立的radius schem:test
 vlan-assignment-mode string         //指定VLAN匹配模式为字符型（string）,也可以指定匹配模式为×××（integer），这个与radius server属性里面的设置是相关联的。
domain system
#                                         
 stp enable
#
#
vlan 1
#
vlan 3

name test
#
vlan 21

name guest-vlan
#                                        
interface Vlan-interface1
 ip address 192.168.0.1 255.255.255.0
#
interface Vlan-interface7
#
interface Aux1/0/0
#
interface Ethernet1/0/1
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/2
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/3
 broadcast-suppression 40    //广播抑制，无关紧要。
 dot1x port-method portbased
 dot1x guest-vlan 21            //验证不通过时，将获得vlan21的内容。
 dot1x
#
interface Ethernet1/0/4                  
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/5
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/6
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/7
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/8
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/9
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/10                 
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/11
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/12
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/13
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/14
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/15
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/16                 
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/17
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/18
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/19
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/20
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/21
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/22                 
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/23
 broadcast-suppression 40
 port access vlan 3
#
interface Ethernet1/0/24
 broadcast-suppression 40
 port access vlan 3
#
interface GigabitEthernet1/1/1
 port link-type trunk
 port trunk permit vlan all
 broadcast-suppression 40
 gvrp
#
interface GigabitEthernet1/1/2
 port link-type trunk
 port trunk permit vlan all
 broadcast-suppression 40
#
interface GigabitEthernet1/1/3
 port link-type trunk                    
 port trunk permit vlan all
 broadcast-suppression 40
 gvrp
#
interface GigabitEthernet1/1/4
 broadcast-suppression 40
 port access vlan 3
#
 undo irf-fabric authentication-mode
#
interface NULL0
#
 voice vlan mac-address 0001-e300-0000 mask ffff-ff00-0000
#
#
#
user-interface aux 0 7
user-interface vty 1 4                   
#
return