9.2.3.13. Huawei

9.2.3.13.1. S5700 Series

Firmware: Version 5.170 (V200R011C10SPC600) (V200R022C00SPC500)

Administration Portal > ON CMDB > Network Devices Brand/Model: Huawei/S5720 or Huawei/Generic depending on the model

9.2.3.13.1.1. AAA Configuration

9.2.3.13.1.1.1. AAA Scheme

Define the AAA Configuration:

aaa
  authentication-scheme opennac
    authentication-mode radius
  accounting-scheme opennac
    accounting-mode radius

9.2.3.13.1.1.2. RADIUS Server

Define the RADIUS template to be used for authentications and their format:

radius-server template opennac
        radius-server shared-key cipher <SharedKey>
        radius-server authentication <OpenNAC IP> 1812 weight 80
        radius-server accounting <OpenNAC IP> 1813 weight 80
        radius-server retransmit 2
        radius-server nas-port-id-format vendor 9
        radius-server retransmit 3 timeout 5
        undo radius-server user-name domain-included

RADIUS Server Status Detection Function:

radius-server dead-interval 5
radius-server dead-count 2
radius-server template opennac
        radius-server testuser username <user-name> password cipher <password>
        radius-server detect-server interval <interval(s)>
        radius-server dead-time dead-time <time (default 5m)>

9.2.3.13.1.1.3. Configuring a Domain

Define the Domain Configuration:

aaa
domain opennac
        authentication-scheme opennac
        accounting-scheme opennac
        radius-server opennac

9.2.3.13.1.1.4. CoA

To perform the policy reevaluation through SNMP, it will be necessary to activate this functionality and define the keys of the reading and writing communities:

radius-server authorization <Radius_Server_IP> server-group <group-name> shared-key cipher <Radius_Shared_Key>
radius-server authorization port <port-id>

Verify configuration:

    display radius-server configuration
display radius-server authorization configuration

9.2.3.13.1.2. NAC Configuration

We can use both unified and common mode to configure the NAC section. The recommended configuration is with unified because it is more understandable and simple, but if you experience any problems you can use the common one.

9.2.3.13.1.2.1. Unified MODE

Auth Mode

display authentication mode
authentication unified-mode

802.1x - Access Profile

dot1x-access-profile name opennac
        dot1x authentication-method eap
        dot1x reauthenticate
        dot1x timer reauthenticate-period { reauth-period(s) (Default 3600) }

MAC-Auth - Access Profile

mac-access-profile name opennac
        mac-authen reauthenticate
        mac-authen timer reauthenticate-period { reauth-period(s) (Default 1800) }

Authentication Profile

authentication-profile name opennac
        dot1x-access-profile opennac
        mac-access-profile opennac
        authentication dot1x-mac-bypass
        authentication update-ip-accounting enable
        access-domain opennac
        link-down offline delay 0 #If available
quit
undo authentication pre-authen-access enable

802.1X + MAC address authentication is mainly applied to scenarios where dumb terminals exist. When a gateway functions as an authentication device, 802.1X + MAC address authentication is not recommended because ARP packets sent by terminals trigger MAC address authentication first. This degrades the performance of 802.1X authentication and ARP attacks may occur.

Authentication Mode (optional)

authentication mode { single-terminal | single-voice-with-data | multi-share | multi-authen [ max-user max-user-number [ dot1x | mac-authen | portal ] * ] }
  • single-terminal: applies to the scenario in which only one data terminal is connected to the network through the interface.

  • single-voice-with-data: applies to the scenario in which only one data terminal is connected to the network on the device interface through a voice terminal.

  • multi-share: applies to the scenario that does not require high security and in which multiple data terminals are connected to the network on the device interface.

  • multi-authen: applies to the scenario that requires high security and in which multiple data terminals are connected to the network on the device interface. In this access mode, you can configure the maximum number of access users based on the actual user quantity on the interface.

Critical VLAN:

authentication-profile name opennac
            authentication event authen-server-down action authorize { vlan vlan-id }
            authentication timer re-authen authen-fail { re-authen-time }
            uthentication event authen-server-up action re-authen

Control Direction:

authentication-profile name emma
            authentication control-direction { all | inbound }

By default, the device only controls the upstream traffic.

802.1x - Timers

dot1x timer tx-period 5 (default 30)
dot1x timer mac-bypass-delay 15 (default 30)
undo authentication pre-authen-access enable

Interface Configuration:

interface Gigabitethernet x/y/z
        port link-type hybrid
        port hybrid vlan <Default-VLAN>
        undo port hybrid pvid vlan 1
        authentication-profile opennac

Verify configuration:

display dot1x-access-profile configuraton name opennac
display mac-access-profile configuration name opennac
display authentication-profile configuration opennac
display authentication interface Gigabitethernet x/y/z

9.2.3.13.1.2.2. Common MODE

Auth Mode

system-view
undo authentication unified-mode

8021X + MAB

  • Global Configuration:

dot1x enable
dot1x timer tx-period 5
mac-authen
  • Interface Configuration:

interface GigabitEthernet X/Y/Z
        port link-type hybrid
        port hybrid vlan <Default-VLAN>
        undo port hybrid pvid vlan 1
        dot1x mac-bypass
        dot1x reauthenticate
        dot1x authentication-method eap
        dot1x domain opennac
        mac-authen domain opennac
        link-down offline delay 0

8021X Re-authentication

interface Gigabitethernet x/y/z
        dot1x reauthenticate
        dot1x timer reauthenticate-period <period-value>

By default, the device re-authenticates online 802.1X authentication users at the interval of 3600 seconds.

MAC-Auth Re-authentication

interface Gigabitethernet x/y/z
            mac-authen reauthenticate
            mac-authen timer reauthenticate-period <period-value>

By default, the device re-authenticates online MAC authentication users at the interval of 3600 seconds.

9.2.3.13.1.3. Security Profiles (ACL’s)

Static

[switch] acl name acl-name [ advance | acl-number ]
[switch-acl-acl_name] description  acl-name
[switch-acl-acl_name] rule [ rule-id ] { deny | permit } tcp [ destination { destination-address destination-wildcard | any } | destination-port { eq | gt | lt | range } port | dscp dscp | fragment | logging | precedence precedence | source { source-address source-wildcard | any } | source-port { eq | gt | lt | range } port | tcp-flag { ack | fin | psh | rst | syn | urg }*  | time-range time-name | tos tos ]*

Dynamic

Example ACL format on OpenNAC Enterprise:

$1 permit dst 10.0.239.192/26
$2 permit udp src any 8080
$3 permit icmp echo dst 10.1.1.1/24
$5 deny
  • The fields are described as follows:

    • $: Start character of each ACL rule.

    • number: Last three digits in an ACL rule number, ranging from 0 to 999. The first two digits of an ACL rule number are fixed to 10. For example, if the value of this field is 12, the ACL rule number is 10012.

    • permit/deny: ACL action. permit indicates that the user access is allowed. deny indicates that the user access is denied.

    • protocol: Protocol type. The value can be tcp, udp, icmp or igmp. ICMP is classified into echo and echo-reply.

    • direction: IP address type. The value can be dst or src. dst indicates a destination IP address and src indicates a source IP address.

    • ip-address: IP address. The value can be any, IPv4 address/mask or IPv6 address/mask.

    • port: Port number. Currently, only one port is supported.

For more information check the “HW-Data-Filter” attribute on Huawei official documentation <https://support.huawei.com/enterprise/en/doc/EDOC1100276761/35071f9a/radius-aaa>.

9.2.3.13.1.4. SNMP

To perform the policy reevaluation through SNMP, it will be necessary to activate this functionality and define the keys of the reading and writing communities:

SNMP-v2c:

snmp-agent
snmp-agent sys-info version v2c
snmp-agent community read cipher <community-name>
snmp-agent community write cipher <community-name>

SNMP-v3:

snmp-agent mib-view included isoview iso
snmp-agent group v3 <SNMPGROUP> privacy read-view isoview write-view isoview notify-view isoview
snmp-agent usm-user v3 <SNMPUSER>
snmp-agent usm-user v3 <SNMPUSER> group <SNMPGROUP>
snmp-agent usm-user v3 <SNMPUSER> authentication-mode sha cipher <AUTH-SECRET>
snmp-agent usm-user v3 <SNMPUSER> privacy-mode aes128 cipher <PRIV-SECRET>
  • SNMP Trap Host

snmp-agent trap enable
snmp-agent target-host trap address udp-domain <opennacIP> params securityname <public> v2c //Configure un host de trap. By default, traps are sent on UDP port 162.

9.2.3.13.1.5. Troubleshooting & Monitoring

  • RADIUS Debug:

<switch> debug radius packet
<switch> terminal monitor
<switch> terminal debug
  • Monitoring NAC:

display access-user     -> information about NAC access users.
display dot1x                   -> information about 802.1X authentication.
display mac-authen              -> information about MAC address authentication.
display server-detect state     -> the status of a Portal server.
display mac-address authen              -> MAC address entries of the authen type in the system.
display mac-address pre-authen  -> MAC address entries of the Pre-authen type in the system.