拓撲圖

規格

適用于所有版本、所有形態的AR路由器。

組網需求

PC通過Router訪問網絡。為了保證網絡的安全性，要求在用戶接入網絡時進行802.1x認證。認證服務器為兩臺Radius服務器，IP為10.10.10.1/24服務器作為主認證服務器，IP為10.10.10.2/24的服務器為備用認證服務器。當主用服務器不可用時，Router可以實現最快3s內切換到備用服務器。

操作步驟

1. Router上的配置

V200R007及之前版本： 
#                                                                                
vlan batch 10                                                                    
#                                                                                
dot1x enable                                                                   
#                                                                                
radius-server template shiva  //配置RADIUS服務器模板shiva                                                     
 radius-server shared-key cipher %^%#Q75cNQ6IF(e#L4WMxP~%^7'u17,]D87GO{"[o]`D%^%#                        
 radius-server authentication 10.10.10.1 1812 //配置RADIUS主用認證服務器                                  
 radius-server authentication 10.10.10.2 1812 secondary //配置RADIUS備用認證服務器                         
#                                                                                
aaa                                                                              
 authentication-scheme scheme0 //創建名為scheme0的認證方案                                                       
  authentication-mode radius                                                                              
 domain huawei //配置名為huawei的域                                                                      
  authentication-scheme scheme0                                                      
  radius-server shiva                                                             
#                                                                                
interface Vlanif10                                                               
 ip address 192.168.1.2 255.255.255.0                                            
#                                                                                
interface Ethernet2/0/0                                                          
 port link-type access                                                           
 port default vlan 10                                                            
 dot1x enable                                                                
# 
V200R008及之后版本： 
#                                                                                
vlan batch 10                                                                    
#                                                                                
authentication-profile name p1 
 dot1x-access-profile d1    //在認證模板p1上綁定802.1x接入模板d1 
#                                                                                
radius-server template shiva  //配置RADIUS服務器模板shiva                                                     
 radius-server shared-key cipher %^%#Q75cNQ6IF(e#L4WMxP~%^7'u17,]D87GO{"[o]`D%^%#                        
 radius-server authentication 10.10.10.1 1812 //配置RADIUS主用認證服務器                                  
 radius-server authentication 10.10.10.2 1812 secondary //配置RADIUS備用認證服務器                         
#                                                                                
aaa                                                                              
 authentication-scheme scheme0 //創建名為scheme0的認證方案                                                       
  authentication-mode radius                                                                              
 domain huawei //配置名為huawei的域                                                                      
  authentication-scheme scheme0                                                      
  radius-server shiva                                                             
#                                                                                
interface Vlanif10                                                               
 ip address 192.168.1.2 255.255.255.0                                            
#                                                                                
interface Ethernet2/0/0                                                          
 port link-type access                                                           
 port default vlan 10                                                            
 authentication-profile p1  //接口下綁定認證模板p1 
# 
dot1x-access-profile name d1 

2. 驗證配置結果

RADIUS服務器添加用戶user1@huawei，密碼Huawei@2012，共享密鑰與路由器保持一致配置為radius。客戶端認證成功后，執行display access-user可以查看Username字段里有用戶名為user1@huawei，并且相應Status字段顯示為Success。

配置注意事項

• 路由器與RADIUS服務器上認證端口的值需要保持一致。
• 路由器和RADIUS服務器上共享密鑰需要保持一致。
• 路由器與RADIUS服務器間需要路由可達