// to display images directly on GitHub
ifdef::env-github[]
:encoding: UTF-8
:lang: en
:doctype: book
:toc: left
:imagesdir: ../../images
endif::[]

////

    This file is part of the PacketFence project.

    See PacketFence_Network_Devices_Configuration_Guide.asciidoc
    for authors, copyright and license information.

////

//=== Huawei

PacketFence supports the S5710/S5720/S5735 switch from Huawei.

==== Global configuration

Global configuration for 802.1X, Mac authentication, accounting and CLI login:

----
undo authentication unified-mode

radius-server template packetfence
 radius-server shared-key cipher <yourSecret>
 radius-server authentication 192.168.1.5 1812
 radius-server accounting 192.168.1.5 1813
 radius-server retransmit 2

# used for RADIUS Disconnect messages
radius-server authorization 192.168.1.5 shared-key cipher <yourSecret>

# to accept RADIUS Disconnect messages with MAC in AA-BB-CC-DD-FF-EE format
radius-server authorization calling-station-id decode-mac-format ascii hyphen-split common

aaa
 authentication-scheme pf-auth
  authentication-mode radius
 accounting-scheme pf-acct
  accounting-mode radius
 # for CLI authentication
 service-scheme pf-cli
 domain pf
  authentication-scheme pf-auth
  accounting-scheme pf-acct
  service-scheme pf-cli
  radius-server packetfence

# set default common domain used for authentication
domain pf
# if you want CLI login
# domain pf admin

dot1x enable
mac-authen
dot1x timer reauthenticate-period 10800
mac-authen timer reauthenticate-period 10800
dot1x dhcp-trigger

snmp-agent
snmp-agent local-engineid 800007DB0304F9389D2360
snmp-agent community read cipher <privateKey>
snmp-agent community write cipher <privateKey>
snmp-agent sys-info version v2c v3
----

==== SNMPv3

----
snmp-agent group v3 MYGROUP privacy read-view SNMP write-view SNMP
snmp-agent usm-user v3 MYUSER
snmp-agent usm-user v3 MYUSER group MYGROUP
snmp-agent usm-user v3 MYUSER authentication-mode md5 cipher SECRET1
snmp-agent usm-user v3 MYUSER privacy-mode aes128 cipher SECRET2
----

==== MAC authentication

----
interface GigabitEthernet0/0/8
 dot1x mac-bypass mac-auth-first
 dot1x mac-bypass
 dot1x max-user 1
 dot1x reauthenticate
 dot1x authentication-method eap
----

==== 802.1X with MAC Auth bypass

----
interface GigabitEthernet0/0/8
 port link-type hybrid
 dot1x mac-bypass
 dot1x max-user 1
 dot1x reauthenticate
 dot1x authentication-method eap
----

==== Voice port

Configuration of a switchport where a phone is plugged:
----
interface GigabitEthernet0/0/2
 port link-type hybrid
 voice-vlan 100 enable
 port hybrid tagged vlan 100
 mac-authen
----

==== Troubleshooting commands

----
display aaa configuration
display dot1x
display access-user
display radius-server
test-aaa user password radius-template packetfence pap
----
