The mute terminal user configuration profile function enables users' mute terminals such as IP phones and printers to connect to the network more conveniently. With this function, you can generate some accounts for mute terminals before they access the network. When a mute terminal accesses the network, the system automatically transforms a pre-generated account to a formal account and binds it to the mute terminal. The formal account uses the MAC address of the terminal as the account name and the user name prefix-MAC address as the user name. You can also add mute terminal users by directly adding accounts, but this is not convenient for users. A good practice is to add mute terminal users through the mute terminal user configuration profile function.
The INC User Access Manager (UAM) component supports MAC authentication of mute terminals. Because different mute terminals may send MAC addresses to UAM in different formats, UAM uses the following authentication mechanism to ensure normal authentication of mute terminals:
1) After receiving an account name from a mute terminal, UAM searches for a fully matched access account for authentication.
2) If UAM cannot find a fully matched access account, it tries to transform the received account name to a MAC address in the format of xx:xx:xx:xx:xx:xx. If the account name cannot be transformed, UAM denies the access.
3) UAM searches for a fully matched access account for the transformed account name to authenticate the mute terminal.
4) UAM uses the mute terminal information to match MAC-range-based and IP-range-based configuration profiles in the descending order of the priority. If no match exists, UAM uses the mute terminal information to match endpoint-identification-based configuration profiles in the descending order of the priority. If a match is found, UAM creates a mute terminal user account for the mute terminal and authenticates the terminal. If no match is found, UAM denies the network access of the mute terminal.
5) If a MAC-range-based configuration profile has a higher priority than IP-range-based configuration profiles, UAM determines whether the transformed account is in the configured MAC address ranges. If the account is in a MAC address range, UAM creates an account for mute terminal and authenticates the terminal. If an IP-range-based configuration profile has a higher priority than MAC-range-based configuration profiles, and the access device sends the IP address of the mute terminal to UAM, UAM determines whether the terminal IP address is in the configured IP ranges. If yes, UAM creates an account by using the MAC address of the mute terminal as the account name and authenticates the terminal.
6) If an endpoint-identification-based configuration profile is configured, and the access device sends the OS, endpoint type, and vendor of the mute terminal to UAM, UAM determines whether one of these endpoint identification items has a match in the configuration profile. If a match exists, UAM creates an account by using the MAC address of the mute terminal as the account name and authenticates the terminal. If no match exists, UAM denies the network access of the mute terminal.