HP ProCurve 2510G Series, Manual

Page: 123 / 320

5-17
RADIUS Authentication, Authorization and Accounting
Controlling Web Browser Interface Access When Using RADIUS Authentication
Controlling Web Browser Interface Access
When Using RADIUS Authentication
To prevent unauthorized access through the web browser interface, do one or
more of the following:
■ Configure local authentication (a Manager user name and password
and, optionally, an Operator user name and password) on the switch.
■ Configure the switch’s Authorized IP Manager feature to allow web
browser access only from authorized management stations. (The
Authorized IP Manager feature does not interfere with
operation.)
■ Disable web browser access to the switch.
Commands Authorization
The RADIUS protocol combines user authentication and authorization steps
into one phase. The user must be successfully authenticated before the
RADIUS server will send authorization information (from the user’s profile)
to the Network Access Server (NAS). After user authentication has occurred,
the authorization information provided by the RADIUS server is stored on the
NAS for the duration of the user’s session. Changes in the user’s authorization
profile during this time will not be effective until after the next authentication
occurs.
You can limit the services for a user by enabling AAA RADIUS authorization.
The NAS uses the information set up on the RADIUS server to control the
user’s access to CLI commands.
The authorization type implemented on the switches covered in this guide is
the “commands” method. This method explicitly specifies on the RADIUS
server which commands are allowed on the client device for authenticated
users. This is done on a per-user or per-group basis.