HP HP ProCurve Series 6600, Access Security Manual

Page: 615 / 778

13-3
Configuring Port-Based and User-Based Access Control (802.1X)
Overview
802.1X User-Based Access Control
802.1X operation with access control on a per-user basis provides client-level
security that allows LAN access to individual 802.1X clients (up to 32 per port),
where each client gains access to the LAN by entering valid user credentials.
This operation improves security by opening a given port only to individually
authenticated clients, while simultaneously blocking access to the same port
for clients that cannot be authenticated. All sessions must use the same
untagged VLAN (unless MAC-based VLANs are enabled. Please see “MAC-
Based VLANs” on page 6-51). Also, an authenticated client can use any tagged
VLAN memberships statically configured on the port, provided the client is
configured to use the tagged VLAN memberships available on the port. (Note
that the session total includes any sessions begun by the Web Authentication
or MAC Authentication features covered in chapter 4.) For more information,
refer to “Option For Authenticator Ports: Configure Port-Security To Allow
Only 802.1X-Authenticated Devices” on page 13-48.
802.1X Port-Based Access Control
802.1X port-based access control provides port-level security that allows LAN
access only on ports where a single 802.1X-capable client (supplicant) has
entered authorized RADIUS user credentials. For reasons outlined below, this
option is recommended for applications where only one client at a time can
connect to the port. Using this option, the port processes all IP traffic as if it
comes from the same client. Thus, in a topology where multiple clients can
connect to the same port at the same time:
■ If the first client authenticates and opens the port, and then another client
authenticates, the port responds as if the original client has initiated a
reauthentication. With multiple clients authenticating on the port, the
RADIUS configuration response to the latest client authentication
replaces any other configuration from an earlier client authentication. If
all clients use the same configuration this should not be a problem. But if
the RADIUS server responds with different configurations for different
clients, then the last client authenticated will effectively lock out any
previously authenticated client. When
any client to authenticate closes
its session, the port will also close and remain so until another client
successfully authenticates.
■ The most recent client authentication determines the untagged VLAN
membership for the port. Also, any client able to use the port can access
any tagged VLAN memberships statically configured on the port, provided
the client is configured to use the available, tagged VLAN memberships.