H3C S3100-52P Manual Download Page 37

Page: 37 / 40

Operation Manual – 802.1x and System Guard
H3C S3100-52P Ethernet switch

Chapter 3 HABP Configuration

3-3

To do...

Use the command...

Remarks

Display statistics on HABP
packets

display habp traffic

Available in any view

Summary of Contents for S3100-52P

Page 1: ...oxy Checking 1 20 1 4 2 Configuring Client Version Checking 1 21 1 4 3 Enabling DHCP triggered Authentication 1 22 1 4 4 Configuring Guest VLAN 1 22 1 4 5 Configuring 802 1x Re Authentication 1 23 1 4...

Page 2: ...4 1 4 1 System Guard Overview 4 1 4 1 1 Guard Against IP Attacks 4 1 4 1 2 Guard Against TCN Attacks 4 1 4 1 3 Layer 3 Error Control 4 1 4 2 Configuring System Guard 4 1 4 2 1 Configuring System Guar...

Page 3: ...anced 802 1x Configuration z Displaying and Maintaining 802 1x Configuration z Configuration Example 1 1 Introduction to 802 1x The 802 1x protocol 802 1x for short was developed by IEEE802 LAN WAN co...

Page 4: ...he authenticator system is another entity residing at one end of a LAN segment It authenticates the connected supplicant systems The authenticator system is usually an 802 1x supported network device...

Page 5: ...In this case no packets can pass through it z Controlled port and uncontrolled port are two properties of a port Packets reaching a port are visible to both the controlled port and uncontrolled port...

Page 6: ...ses the information about the supplicant system to the authenticator system The authenticator system in turn determines the state authorized or unauthorized of the controlled port according to the ins...

Page 7: ...licant system and the authenticator system EAP packets are encapsulated by RADIUS protocol to allow them successfully reach the authentication servers Network management related information such as al...

Page 8: ...RADIUS protocol packet for EAP authentication Refer to the Introduction to RADIUS protocol section in the AAA Operation for information about the format of a RADIUS protocol packet The EAP message fie...

Page 9: ...ty and Protected Extensible Authentication Protocol PEAP are available in the EAP relay mode z EAP MD5 authenticates the supplicant system The RADIUS server sends MD5 keys contained in EAP request MD5...

Page 10: ...client to initiate an access request by sending an EAPoL start packet to the switch with its user name and password provided The 802 1x client program then forwards the packet to the switch to start...

Page 11: ...allow the supplicant system to access the network z The supplicant system can also terminate the authenticated state by sending EAPoL Logoff packets to the switch The switch then changes the port sta...

Page 12: ...at in the EAP relay mode except that the randomly generated key in the EAP terminating mode is generated by the switch and that it is the switch that sends the user name the randomly generated key and...

Page 13: ...em if the switch does not receive the response from the supplicant system when this timer times out z Transmission timer tx period This timer sets the tx period and is triggered by the switch in two c...

Page 14: ...but sends no Trap packets z Sends Trap packets without disconnecting the supplicant system This function needs the cooperation of 802 1x client and a CAMS server z The 802 1x client needs to be capabl...

Page 15: ...ables supplicant systems that are not authenticated to upgrade their 802 1x client programs With this function enabled z The switch sends authentication triggering request EAP Request Identity packets...

Page 16: ...username and password any more z An authentication server running CAMS authenticates the username and password during re authentication of a user in the EAP authentication mode but does not in PAP or...

Page 17: ...AA scheme Local authentication RADIUS scheme 802 1x configuration Figure 1 11 802 1x configuration z 802 1x users use domain names to associate with the ISP domains configured on switches z Configure...

Page 18: ...02 1x is disabled globally In system view dot1x interface interface list interface interface type interface number dot1x Enable 802 1x for specified ports In port view quit Required By default 802 1x...

Page 19: ...entication method chap pap eap Optional By default a switch performs CHAP authentication in EAP terminating mode Enable online user handshaking dot1x handshake enable Optional By default online user h...

Page 20: ...or not a user is online z As clients that are not of H3C do not support the online user handshaking function switches cannot receive handshake acknowledgement packets from them in handshaking periods...

Page 21: ...default Set 802 1x timers dot1x timer handshake period handshake period value quiet period quiet period value server timeout server timeout value supp timeout supp timeout value tx period tx period v...

Page 22: ...ecting and so on z Client version checking configuration z DHCP triggered authentication z Guest VLAN configuration z 802 1x re authentication configuration z Configuration of the 802 1x re authentica...

Page 23: ...tch too by using the dot1x version check command 1 4 2 Configuring Client Version Checking Follow these steps to configure client version checking To do Use the command Remarks Enter system view syste...

Page 24: ...mic IP addresses through DHCP Follow these steps to enable DHCP triggered authentication To do Use the command Remarks Enter system view system view Enable DHCP triggered authentication dot1x dhcp lau...

Page 25: ...In port view dot1x re authenticate Required By default 802 1x re authentication is disabled on a port Note z To enable 802 1x re authentication on a port you must first enable 802 1x globally and on t...

Page 26: ...value of the Session timeout attribute field as the re authentication interval The following introduces how to configure the 802 1x re authentication timer on the switch Follow these steps to configu...

Page 27: ...11 1 1 operates as the primary authentication server and the secondary accounting server The other operates as the secondary authentication server and primary accounting server The password for the s...

Page 28: ...n IP addresses to the primary authentication and accounting RADIUS servers Sysname radius radius1 primary authentication 10 11 1 1 Sysname radius radius1 primary accounting 10 11 1 2 Assign IP address...

Page 29: ...ver is invalid specify to adopt the local authentication scheme Sysname isp aabbcc net scheme radius scheme radius1 local Specify the maximum number of users the user domain can accommodate to 30 Sysn...

Page 30: ...s the forcible deployment of EAD clients with 802 1x authentication easing the work of EAD client deployment 2 1 2 Operation of Quick EAD Deployment Quick EAD deployment is achieved with the two funct...

Page 31: ...2 1x on the switch z Set the access mode to auto for 802 1x enabled ports 2 2 2 Configuration Procedure I Configuring a free IP range A free IP range is an IP range that users can access before passin...

Page 32: ...upport port security The configured free IP range cannot take effect if you enable port security II Setting the ACL timeout period The quick EAD deployment function depends on ACLs in restricting acce...

Page 33: ...Quick EAD Deployment Configuration Example I Network requirements A user connects to the switch directly The switch connects to the Web server and the Internet The user will be redirected to the Web s...

Page 34: ...than the dotted decimal notation the user may not be redirected This is related with the operating system used on the PC In this case the PC considers the IP address string a name and tries to resolve...

Page 35: ...802 1x authentications when traveling between HABP enabled switches through which management devices can obtain the MAC addresses of the attached switches and thus the management of the attached swit...

Page 36: ...HABP server to send HABP request packets is 20 seconds 3 3 HABP Client Configuration HABP clients reside on switches attached to HABP servers After you enable HABP for a switch the switch operates as...

Page 37: ...ion Manual 802 1x and System Guard H3C S3100 52P Ethernet switch Chapter 3 HABP Configuration 3 3 To do Use the command Remarks Display statistics on HABP packets display habp traffic Available in any...

Page 38: ...ding packets for that host z If the packets from the infected host need processing by the CPU the switch decreases the precedence of such packets and discards the packets already delivered to the CPU...

Page 39: ...d is 30 record times threshold is 1 and isolate time is 3 Note The correlations among the arguments of the system guard ip detect threshold command can be clearly described with this example If you se...

Page 40: ...10 second monitoring cycle the system will not send trap or log information in the next 10 second monitoring cycle 4 2 3 Enabling Layer 3 Error Control Follow these steps to enable Layer 3 error contr...

Search results

Summary of Contents for S3100-52P

Reviews:

Related manuals for S3100-52P

Brands by name

Popular brands

H3C S3100-52P, Manual

Search results

Summary of Contents for S3100-52P

Reviews:

Related manuals for S3100-52P

Brands by name

Popular brands