华为 S5735 802.1X 认证配置：对接 Radius 服务器实战

一、802.1X 认证概述与 S5735 协作流程

1.1 802.1X 认证基本原理

802.1X 是一种基于端口的网络访问控制协议，用于限制未经授权的设备接入局域网。它定义了三个核心角色：Supplicant（客户端，如电脑）、Authenticator（认证者，如交换机）和 Authentication Server（认证服务器，如 Radius 服务器）。认证者作为中间人，负责转发客户端和认证服务器之间的认证报文，并根据认证结果控制端口的访问权限。

1.2 S5735 交换机与 Radius 服务器协作流程

在典型的 802.1X 部署中，S5735 交换机作为 Authenticator，负责与接入的客户端进行 EAPOL（Extensible Authentication Protocol over LAN）报文交互，并将认证请求转发给后端的 Radius 服务器。Radius 服务器则负责验证用户的身份凭证，并返回认证结果（成功或失败）给交换机，交换机再据此允许或拒绝客户端访问网络。

#publish-mermaid-0-1793102845013{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-0-1793102845013 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-0-1793102845013 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-0-1793102845013 .error-icon{fill:#552222;}#publish-mermaid-0-1793102845013 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-0-1793102845013 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-0-1793102845013 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-0-1793102845013 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-0-1793102845013 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-0-1793102845013 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-0-1793102845013 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-0-1793102845013 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-0-1793102845013 .marker.cross{stroke:#333333;}#publish-mermaid-0-1793102845013 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-0-1793102845013 p{margin:0;}#publish-mermaid-0-1793102845013 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#publish-mermaid-0-1793102845013 .cluster-label text{fill:#333;}#publish-mermaid-0-1793102845013 .cluster-label span{color:#333;}#publish-mermaid-0-1793102845013 .cluster-label span p{background-color:transparent;}#publish-mermaid-0-1793102845013 .label text,#publish-mermaid-0-1793102845013 span{fill:#333;color:#333;}#publish-mermaid-0-1793102845013 .node rect,#publish-mermaid-0-1793102845013 .node circle,#publish-mermaid-0-1793102845013 .node ellipse,#publish-mermaid-0-1793102845013 .node polygon,#publish-mermaid-0-1793102845013 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-0-1793102845013 .rough-node .label text,#publish-mermaid-0-1793102845013 .node .label text,#publish-mermaid-0-1793102845013 .image-shape .label,#publish-mermaid-0-1793102845013 .icon-shape .label{text-anchor:middle;}#publish-mermaid-0-1793102845013 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#publish-mermaid-0-1793102845013 .rough-node .label,#publish-mermaid-0-1793102845013 .node .label,#publish-mermaid-0-1793102845013 .image-shape .label,#publish-mermaid-0-1793102845013 .icon-shape .label{text-align:center;}#publish-mermaid-0-1793102845013 .node.clickable{cursor:pointer;}#publish-mermaid-0-1793102845013 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#publish-mermaid-0-1793102845013 .arrowheadPath{fill:#333333;}#publish-mermaid-0-1793102845013 .edgePath .path{stroke:#333333;stroke-width:1px;}#publish-mermaid-0-1793102845013 .flowchart-link{stroke:#333333;fill:none;}#publish-mermaid-0-1793102845013 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-0-1793102845013 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-0-1793102845013 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-0-1793102845013 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#publish-mermaid-0-1793102845013 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#publish-mermaid-0-1793102845013 .cluster text{fill:#333;}#publish-mermaid-0-1793102845013 .cluster span{color:#333;}#publish-mermaid-0-1793102845013 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#publish-mermaid-0-1793102845013 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-0-1793102845013 rect.text{fill:none;stroke-width:0;}#publish-mermaid-0-1793102845013 .icon-shape,#publish-mermaid-0-1793102845013 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-0-1793102845013 .icon-shape p,#publish-mermaid-0-1793102845013 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#publish-mermaid-0-1793102845013 .icon-shape .label rect,#publish-mermaid-0-1793102845013 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-0-1793102845013 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#publish-mermaid-0-1793102845013 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#publish-mermaid-0-1793102845013 .node .neo-node{stroke:#9370DB;}#publish-mermaid-0-1793102845013 [data-look=\”neo\”].node rect,#publish-mermaid-0-1793102845013 [data-look=\”neo\”].cluster rect,#publish-mermaid-0-1793102845013 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793102845013 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-0-1793102845013 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-0-1793102845013 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793102845013 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-0-1793102845013 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793102845013 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-0-1793102845013 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793102845013 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793102845013 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}EAPOL-StartAccess-RequestAccess-ChallengeEAP-Request/IdentityEAP-Response/IdentityAccess-RequestAccess-AcceptEAP-SuccessAccess-RejectEAP-Failure

客户端

交换机

Radius服务器

该流程图展示了完整的 EAP 认证过程，从客户端发起请求到最终认证结果返回。

Radius服务器交换机客户端Radius服务器交换机客户端#publish-mermaid-1-1793102849231{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-1-1793102849231 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-1-1793102849231 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-1-1793102849231 .error-icon{fill:#552222;}#publish-mermaid-1-1793102849231 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-1-1793102849231 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-1-1793102849231 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-1-1793102849231 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-1-1793102849231 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-1-1793102849231 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-1-1793102849231 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-1-1793102849231 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-1-1793102849231 .marker.cross{stroke:#333333;}#publish-mermaid-1-1793102849231 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-1-1793102849231 p{margin:0;}#publish-mermaid-1-1793102849231 .actor{stroke:#9370DB;fill:#ECECFF;stroke-width:1;}#publish-mermaid-1-1793102849231 rect.actor.outer-path[data-look=\”neo\”]{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793102849231 rect.note[data-look=\”neo\”]{stroke:#aaaa33;fill:#fff5ad;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793102849231 text.actor>tspan{fill:black;stroke:none;}#publish-mermaid-1-1793102849231 .actor-line{stroke:#9370DB;}#publish-mermaid-1-1793102849231 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#publish-mermaid-1-1793102849231 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#publish-mermaid-1-1793102849231 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#publish-mermaid-1-1793102849231 [id$=\”-arrowhead\”] path{fill:#333;stroke:#333;}#publish-mermaid-1-1793102849231 .sequenceNumber{fill:white;}#publish-mermaid-1-1793102849231 [id$=\”-sequencenumber\”]{fill:#333;}#publish-mermaid-1-1793102849231 [id$=\”-crosshead\”] path{fill:#333;stroke:#333;}#publish-mermaid-1-1793102849231 .messageText{fill:#333;stroke:none;}#publish-mermaid-1-1793102849231 .labelBox{stroke:#9370DB;fill:#ECECFF;filter:none;}#publish-mermaid-1-1793102849231 .labelText,#publish-mermaid-1-1793102849231 .labelText>tspan{fill:black;stroke:none;}#publish-mermaid-1-1793102849231 .loopText,#publish-mermaid-1-1793102849231 .loopText>tspan{fill:black;stroke:none;}#publish-mermaid-1-1793102849231 .sectionTitle,#publish-mermaid-1-1793102849231 .sectionTitle>tspan{fill:black;stroke:none;}#publish-mermaid-1-1793102849231 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:#9370DB;fill:#9370DB;}#publish-mermaid-1-1793102849231 .note{stroke:#aaaa33;fill:#fff5ad;}#publish-mermaid-1-1793102849231 .noteText,#publish-mermaid-1-1793102849231 .noteText>tspan{fill:black;stroke:none;font-weight:normal;}#publish-mermaid-1-1793102849231 .activation0{fill:#f4f4f4;stroke:#666;}#publish-mermaid-1-1793102849231 .activation1{fill:#f4f4f4;stroke:#666;}#publish-mermaid-1-1793102849231 .activation2{fill:#f4f4f4;stroke:#666;}#publish-mermaid-1-1793102849231 .actorPopupMenu{position:absolute;}#publish-mermaid-1-1793102849231 .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#publish-mermaid-1-1793102849231 .actor-man circle,#publish-mermaid-1-1793102849231 line{fill:#ECECFF;stroke-width:2px;}#publish-mermaid-1-1793102849231 g rect.rect{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));stroke:#9370DB;}#publish-mermaid-1-1793102849231 .node .neo-node{stroke:#9370DB;}#publish-mermaid-1-1793102849231 [data-look=\”neo\”].node rect,#publish-mermaid-1-1793102849231 [data-look=\”neo\”].cluster rect,#publish-mermaid-1-1793102849231 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793102849231 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-1-1793102849231 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-1-1793102849231 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793102849231 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-1-1793102849231 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793102849231 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-1-1793102849231 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793102849231 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793102849231 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}EAPOL-StartAccess-RequestAccess-ChallengeEAP-Request/IdentityEAP-Response/IdentityAccess-RequestAccess-AcceptEAP-Success

时序图清晰地展示了 EAP-MD5 认证中各方的交互顺序，确保了认证过程的严谨性。

二、配置前准备

2.1 设备与网络拓扑

本次实战采用以下网络拓扑：

2.2 Radius 服务器信息

在配置交换机前，需确认 Radius 服务器的以下信息：

• Radius 服务器 IP 地址：192.168.1.100
• Radius 共享密钥：radius_key
• 认证端口：1812
• 计费端口：1813

三、S5735 交换机配置步骤

S5735 交换机配置 802.1X 的主要步骤可以概括为以下流程图。

#publish-mermaid-2-1793102849267{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-2-1793102849267 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-2-1793102849267 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-2-1793102849267 .error-icon{fill:#552222;}#publish-mermaid-2-1793102849267 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-2-1793102849267 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-2-1793102849267 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-2-1793102849267 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-2-1793102849267 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-2-1793102849267 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-2-1793102849267 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-2-1793102849267 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-2-1793102849267 .marker.cross{stroke:#333333;}#publish-mermaid-2-1793102849267 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-2-1793102849267 p{margin:0;}#publish-mermaid-2-1793102849267 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#publish-mermaid-2-1793102849267 .cluster-label text{fill:#333;}#publish-mermaid-2-1793102849267 .cluster-label span{color:#333;}#publish-mermaid-2-1793102849267 .cluster-label span p{background-color:transparent;}#publish-mermaid-2-1793102849267 .label text,#publish-mermaid-2-1793102849267 span{fill:#333;color:#333;}#publish-mermaid-2-1793102849267 .node rect,#publish-mermaid-2-1793102849267 .node circle,#publish-mermaid-2-1793102849267 .node ellipse,#publish-mermaid-2-1793102849267 .node polygon,#publish-mermaid-2-1793102849267 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-2-1793102849267 .rough-node .label text,#publish-mermaid-2-1793102849267 .node .label text,#publish-mermaid-2-1793102849267 .image-shape .label,#publish-mermaid-2-1793102849267 .icon-shape .label{text-anchor:middle;}#publish-mermaid-2-1793102849267 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#publish-mermaid-2-1793102849267 .rough-node .label,#publish-mermaid-2-1793102849267 .node .label,#publish-mermaid-2-1793102849267 .image-shape .label,#publish-mermaid-2-1793102849267 .icon-shape .label{text-align:center;}#publish-mermaid-2-1793102849267 .node.clickable{cursor:pointer;}#publish-mermaid-2-1793102849267 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#publish-mermaid-2-1793102849267 .arrowheadPath{fill:#333333;}#publish-mermaid-2-1793102849267 .edgePath .path{stroke:#333333;stroke-width:1px;}#publish-mermaid-2-1793102849267 .flowchart-link{stroke:#333333;fill:none;}#publish-mermaid-2-1793102849267 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-2-1793102849267 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-2-1793102849267 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-2-1793102849267 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#publish-mermaid-2-1793102849267 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#publish-mermaid-2-1793102849267 .cluster text{fill:#333;}#publish-mermaid-2-1793102849267 .cluster span{color:#333;}#publish-mermaid-2-1793102849267 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#publish-mermaid-2-1793102849267 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-2-1793102849267 rect.text{fill:none;stroke-width:0;}#publish-mermaid-2-1793102849267 .icon-shape,#publish-mermaid-2-1793102849267 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-2-1793102849267 .icon-shape p,#publish-mermaid-2-1793102849267 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#publish-mermaid-2-1793102849267 .icon-shape .label rect,#publish-mermaid-2-1793102849267 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-2-1793102849267 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#publish-mermaid-2-1793102849267 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#publish-mermaid-2-1793102849267 .node .neo-node{stroke:#9370DB;}#publish-mermaid-2-1793102849267 [data-look=\”neo\”].node rect,#publish-mermaid-2-1793102849267 [data-look=\”neo\”].cluster rect,#publish-mermaid-2-1793102849267 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793102849267 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-2-1793102849267 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-2-1793102849267 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793102849267 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-2-1793102849267 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793102849267 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-2-1793102849267 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793102849267 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793102849267 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

准备阶段

基础配置

AAA方案配置

Radius服务器配置

802.1X域配置

接口使能

验证

此流程图提供了一个高层次的配置路径，帮助读者按部就班地完成配置。

3.1 基础配置：VLAN 与接口

首先，确保交换机的管理 VLAN 和接入 VLAN 已正确配置，并创建用于测试的 VLAN。

system-view
vlan batch 10 20
interface GigabitEthernet 0/0/1
port link-type access
port default vlan 10
quit

3.2 AAA 认证方案配置

AAA（Authentication, Authorization, Accounting）是 802.1X 认证的基础框架。我们需要创建一个认证方案，指定使用 Radius 认证方法。

aaa
authentication-scheme dot1x_auth
authentication-mode radius
quit

3.3 Radius 服务器配置

在交换机上定义 Radius 服务器，包括其 IP 地址、端口号和共享密钥。

radius-server template radius_server
radius-server authentication 192.168.1.100 1812
radius-server shared-key cipher radius_key
quit

3.4 802.1X 域与认证模式配置

创建一个 802.1X 域，并将之前创建的 AAA 认证方案和 Radius 服务器模板关联到该域。同时，配置认证模式为 EAP（可扩展认证协议）。

dot1x authentication default dot1x_auth
dot1x domain default
authentication-method eap
radius-server radius_server
quit

3.5 接口下 802.1X 使能

最后，在需要启用 802.1X 认证的接口上开启该功能。

interface GigabitEthernet 0/0/1
dot1x enable
quit

四、Radius 服务器配置

4.1 用户账户创建

在 FreeRADIUS 服务器上，需要为测试客户端创建一个用户账户。编辑 users 文件（通常位于 /etc/freeradius/3.0/users）。

# /etc/freeradius/3.0/users
"test_user" Cleartext-Password := "test_password"

4.2 客户端配置

在 FreeRADIUS 服务器上，也需要将 S5735 交换机配置为 Radius 客户端。

# /etc/freeradius/3.0/clients.conf
client s5735_switch {
ipaddr = 192.168.1.1
secret = radius_key
require_message_authenticator = yes
}

五、验证与故障排查

5.1 验证命令

配置完成后，可以使用以下命令在 S5735 交换机上验证 802.1X 配置和认证状态。

display dot1x
display radius-server configuration
display dot1x interface GigabitEthernet 0/0/1

5.2 常见问题

• 认证失败： 检查 Radius 服务器 IP、端口、共享密钥是否正确；检查用户名和密码是否匹配；检查防火墙是否阻止了交换机与 Radius 服务器之间的通信。
• 端口状态异常： 检查端口是否已正确加入 VLAN；检查 802.1X 是否在接口下正确使能；检查 AAA 方案和域的配置是否正确关联。

802.1X 端口有明确的状态机，其状态转换如下所示。

#publish-mermaid-3-1793102849329{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-3-1793102849329 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-3-1793102849329 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-3-1793102849329 .error-icon{fill:#552222;}#publish-mermaid-3-1793102849329 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-3-1793102849329 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-3-1793102849329 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-3-1793102849329 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-3-1793102849329 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-3-1793102849329 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-3-1793102849329 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-3-1793102849329 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-3-1793102849329 .marker.cross{stroke:#333333;}#publish-mermaid-3-1793102849329 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-3-1793102849329 p{margin:0;}#publish-mermaid-3-1793102849329 defs [id$=\”-barbEnd\”]{fill:#333333;stroke:#333333;}#publish-mermaid-3-1793102849329 g.stateGroup text{fill:#9370DB;stroke:none;font-size:10px;}#publish-mermaid-3-1793102849329 g.stateGroup text{fill:#333;stroke:none;font-size:10px;}#publish-mermaid-3-1793102849329 g.stateGroup .state-title{font-weight:bolder;fill:#131300;}#publish-mermaid-3-1793102849329 g.stateGroup rect{fill:#ECECFF;stroke:#9370DB;}#publish-mermaid-3-1793102849329 g.stateGroup line{stroke:#333333;stroke-width:1;}#publish-mermaid-3-1793102849329 .transition{stroke:#333333;stroke-width:1;fill:none;}#publish-mermaid-3-1793102849329 .stateGroup .composit{fill:white;border-bottom:1px;}#publish-mermaid-3-1793102849329 .stateGroup .alt-composit{fill:#e0e0e0;border-bottom:1px;}#publish-mermaid-3-1793102849329 .state-note{stroke:#aaaa33;fill:#fff5ad;}#publish-mermaid-3-1793102849329 .state-note text{fill:black;stroke:none;font-size:10px;}#publish-mermaid-3-1793102849329 .stateLabel .box{stroke:none;stroke-width:0;fill:#ECECFF;opacity:0.5;}#publish-mermaid-3-1793102849329 .edgeLabel .label rect{fill:#ECECFF;opacity:0.5;}#publish-mermaid-3-1793102849329 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-3-1793102849329 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-3-1793102849329 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-3-1793102849329 .edgeLabel .label text{fill:#333;}#publish-mermaid-3-1793102849329 .label div .edgeLabel{color:#333;}#publish-mermaid-3-1793102849329 .stateLabel text{fill:#131300;font-size:10px;font-weight:bold;}#publish-mermaid-3-1793102849329 .node circle.state-start{fill:#333333;stroke:#333333;}#publish-mermaid-3-1793102849329 .node .fork-join{fill:#333333;stroke:#333333;}#publish-mermaid-3-1793102849329 .node circle.state-end{fill:#9370DB;stroke:white;stroke-width:1.5;}#publish-mermaid-3-1793102849329 .end-state-inner{fill:white;stroke-width:1.5;}#publish-mermaid-3-1793102849329 .node rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-3-1793102849329 .node polygon{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-3-1793102849329 [id$=\”-barbEnd\”]{fill:#333333;}#publish-mermaid-3-1793102849329 .statediagram-cluster rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-3-1793102849329 .cluster-label,#publish-mermaid-3-1793102849329 .nodeLabel{color:#131300;}#publish-mermaid-3-1793102849329 .statediagram-cluster rect.outer{rx:5px;ry:5px;}#publish-mermaid-3-1793102849329 .statediagram-state .divider{stroke:#9370DB;}#publish-mermaid-3-1793102849329 .statediagram-state .title-state{rx:5px;ry:5px;}#publish-mermaid-3-1793102849329 .statediagram-cluster.statediagram-cluster .inner{fill:white;}#publish-mermaid-3-1793102849329 .statediagram-cluster.statediagram-cluster-alt .inner{fill:#f0f0f0;}#publish-mermaid-3-1793102849329 .statediagram-cluster .inner{rx:0;ry:0;}#publish-mermaid-3-1793102849329 .statediagram-state rect.basic{rx:5px;ry:5px;}#publish-mermaid-3-1793102849329 .statediagram-state rect.divider{stroke-dasharray:10,10;fill:#f0f0f0;}#publish-mermaid-3-1793102849329 .note-edge{stroke-dasharray:5;}#publish-mermaid-3-1793102849329 .statediagram-note rect{fill:#fff5ad;stroke:#aaaa33;stroke-width:1px;rx:0;ry:0;}#publish-mermaid-3-1793102849329 .statediagram-note rect{fill:#fff5ad;stroke:#aaaa33;stroke-width:1px;rx:0;ry:0;}#publish-mermaid-3-1793102849329 .statediagram-note text{fill:black;}#publish-mermaid-3-1793102849329 .statediagram-note .nodeLabel{color:black;}#publish-mermaid-3-1793102849329 .statediagram .edgeLabel{color:red;}#publish-mermaid-3-1793102849329 [id$=\”-dependencyStart\”],#publish-mermaid-3-1793102849329 [id$=\”-dependencyEnd\”]{fill:#333333;stroke:#333333;stroke-width:1;}#publish-mermaid-3-1793102849329 .statediagramTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].statediagram-cluster rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1;}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].statediagram-cluster rect.outer{rx:5px;ry:5px;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793102849329 .node .neo-node{stroke:#9370DB;}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].node rect,#publish-mermaid-3-1793102849329 [data-look=\”neo\”].cluster rect,#publish-mermaid-3-1793102849329 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793102849329 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793102849329 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}认证成功认证失败下线重新认证

Unauthorized

Authorized

Blocked

该状态图说明了端口在认证过程中的状态变化，有助于故障排查。

六、总结

通过本文的实战配置，我们成功地在华为 S5735 交换机上部署了 802.1X 端口认证，并实现了与 Radius 服务器的无缝对接。关键在于正确理解 802.1X 的原理，并按照 AAA -> Radius 服务器 -> 802.1X 域 -> 接口的顺序进行配置。配置完成后，通过验证命令和观察端口状态，可以确保认证功能正常工作，从而有效提升网络的安全性。网络组件之间的关系可以用 ER 图来表示，如下所示。

#publish-mermaid-4-1793102849424{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-4-1793102849424 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-4-1793102849424 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-4-1793102849424 .error-icon{fill:#552222;}#publish-mermaid-4-1793102849424 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-4-1793102849424 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-4-1793102849424 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-4-1793102849424 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-4-1793102849424 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-4-1793102849424 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-4-1793102849424 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-4-1793102849424 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-4-1793102849424 .marker.cross{stroke:#333333;}#publish-mermaid-4-1793102849424 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-4-1793102849424 p{margin:0;}#publish-mermaid-4-1793102849424 .entityBox{fill:#ECECFF;stroke:#9370DB;}#publish-mermaid-4-1793102849424 .relationshipLabelBox{fill:hsl(80, 100%, 96.2745098039%);opacity:0.7;background-color:hsl(80, 100%, 96.2745098039%);}#publish-mermaid-4-1793102849424 .relationshipLabelBox rect{opacity:0.5;}#publish-mermaid-4-1793102849424 .labelBkg{background-color:rgba(248.6666666666, 255, 235.9999999999, 0.5);}#publish-mermaid-4-1793102849424 .edgeLabel{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-4-1793102849424 .edgeLabel .label rect{fill:rgba(232,232,232, 0.8);}#publish-mermaid-4-1793102849424 .edgeLabel .label text{fill:#333;}#publish-mermaid-4-1793102849424 .edgeLabel .label{fill:#9370DB;font-size:14px;}#publish-mermaid-4-1793102849424 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#publish-mermaid-4-1793102849424 .edge-pattern-dashed{stroke-dasharray:8,8;}#publish-mermaid-4-1793102849424 .node rect,#publish-mermaid-4-1793102849424 .node circle,#publish-mermaid-4-1793102849424 .node ellipse,#publish-mermaid-4-1793102849424 .node polygon{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-4-1793102849424 .relationshipLine{stroke:#333333;stroke-width:1px;fill:none;}#publish-mermaid-4-1793102849424 .marker{fill:none!important;stroke:#333333!important;stroke-width:1;}#publish-mermaid-4-1793102849424 [data-look=neo].labelBkg{background-color:rgba(248.6666666666, 255, 235.9999999999, 0.5);}#publish-mermaid-4-1793102849424 .node .neo-node{stroke:#9370DB;}#publish-mermaid-4-1793102849424 [data-look=\”neo\”].node rect,#publish-mermaid-4-1793102849424 [data-look=\”neo\”].cluster rect,#publish-mermaid-4-1793102849424 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793102849424 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-4-1793102849424 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-4-1793102849424 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793102849424 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-4-1793102849424 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793102849424 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-4-1793102849424 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793102849424 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793102849424 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}连接认证认证

SWITCH

CLIENT

RADIUS_SERVER

ER 图清晰地展示了交换机作为认证中继的角色，连接客户端和认证服务器。