Huawei Switch Access Devices

Huawei switches control access for authorized devices using NAC, AAA protocols, and IAM role-based permissions to ensure secure network connectivity. Network Admission Control (NAC) and AAAHuawei switches implement Network Admission Control (NAC) in unified mode, which handles authentication, authorization, and accounting for both device administrators and access users.

NA

C ensures that only authorized devices can connect to the network. Access authentication is typically performed using RADIUS or HWTACACS, which communicate with AAA servers in a client/server model.

HWTACAC

S encrypts the entire packet and separates authentication from authorization, while RADIUS encrypts only the password and combines authentication and authorization.

Role-

Based Access with IAMFor enterprise environments, Huawei provides Identity and Access Management (IAM) to control access to switch resources. Administrators can: Create IAM users based on organizational structure. Assign users to groups and grant permissions according to their roles.

Use system-defined policies like Tenant Guest to restrict access to only necessary functions. Verify permissions by logging in as the user and checking access to the Enterprise Switch console. This approach allows granular control over which devices or personnel can perform operations on the switch.

CLI Commands for Managing Authorized Devices

Huawei switches provide CLI commands to monitor and manage connected devices: Display connected devices: Use display mac-address to list MAC addresses of devices connected to the switch.

Check AR

P table: display arp shows IP and MAC addresses of recently communicating devices. Interface status: display interface brief shows which ports are active and their speed/duplex settings.

LLD

P neighbors: display lldp neighbor identifies neighboring devices, their type, and port connections. User creation and AAA configuration: Use commands to create local users, set passwords, define service types (SSH, Telnet), and assign access levels (1–15). Verify with display local-user.

VLAN and Port-

Based Access Control

To restrict device access further, administrators can assign ports to specific VLANs in access mode using CLI commands. For example: CodeCopysystem-viewinterface Gigabitethernet0/0/1port link-type accessport default vlan 10 This ensures that only devices connected to authorized ports and VLANs can access the network.

Best Practices

Use centralized AAA servers for consistent authentication and authorization. Apply role-based IAM policies to limit permissions to only what is necessary. Regularly monitor connected devices using MAC address tables and LLDP neighbors.

Combine port-based VLAN assignments with NAC policies for enhanced security. By integrating NAC, AAA, IAM roles, and CLI-based monitoring, Huawei switches provide a robust framework to manage and authorize devices securely on the network.