H3C S5120-EI Series, Operation Manual

Page: 585 / 1191

1-1
1
HABP Configuration
When configuring HABP, go to these sections for the information you are interested in:
z
Introduction to HABP
z
Configuring HABP
z
Displaying and Maintaining HABP
z
HABP Configuration Example
Introduction to HABP
The HW Authentication Bypass Protocol (HABP) is used to enable the downstream network devices of
an 802.1X or MAC authentication enabled access device to bypass 802.1X authentication and MAC
authentication.
As shown in
Figure 1-1 , 802.1X authenticator Switch A has two switches attached to it: Switch B and
Switch C. On Switch A, 802.1X authentication is enabled globally and on the ports connecting the
downstream network devices. The end-user devices (the supplicants) run the 802.1X client software for
802.1X authentication. For Switch B and Switch D, where 802.1X client is not supported (which is
typical of network devices), the communication between them will fail because they cannot pass 802.1X
authentication and their packets will be blocked on Switch A. To allow the two switches to communicate,
you can use HABP.
Figure 1-1
Network diagram for HABP application
Internet
Switch B Switch C
Authenticator
Supplicant
Switch A
Supplicant Supplicant
Switch D Switch E
Authentication
server
HABP is a link layer protocol that works above the MAC layer. It is built on the client-server model.
Generally, the HABP server is assumed by the authentication device (which is enabled with 802.1X or
MAC authentication, such as Switch A in the above example), and the attached switches function as the
HABP clients, such as Switch B through Switch E in the example. No device can function as both an
HABP server and a client at the same time. Typically, the HABP server sends HABP requests to all its
clients periodically to collect their MAC addresses, and the clients respond to the requests. After the