HP ProCurve 2510G Series, Manual

Page: 210 / 320

8-12
Configuring Port-Based and Client-Based Access Control (802.1X)
General Operating Rules and Notes
2. The RADIUS server then responds with an MD5 access challenge that
switch “B” forwards to port A1 on switch “A”.
3. Port A1 replies with an MD5 hash response based on its username and
password or other unique credentials. Switch “B” forwards this response
to the RADIUS server.
4. The RADIUS server then analyzes the response and sends either a “suc-
cess” or “failure” packet back through switch “B” to port A1.
• A “success” response unblocks port B5 to normal traffic from port A1.
• A “failure” response continues the block on port B5 and causes port
A1 to wait for the “held-time” period before trying again to achieve
authentication through port B5.
N o t e
You can configure a switch port to operate as both a supplicant and an
authenticator at the same time.
General Operating Rules and Notes
■ In the client-based mode, when there is an authenticated client on a port,
the following traffic movement is allowed:
• Multicast and broadcast traffic is allowed on the port.
• Unicast traffic to authenticated clients on the port is allowed.
• All traffic from authenticated clients on the port is allowed.
■
When a port on the switch is configured as either an authenticator or
supplicant and is connected to another device, rebooting the switch
causes a re-authentication of the link.
■
Using client-based 802.1X authentication, when a port on the switch is
configured as an authenticator the port allows only authenticated clients
up to the currently configured client limit.
For clients that do not have the proper 802.1X supplicant software, the
optional 802.1X Open VLAN mode can be used to open a path for down-
loading 802.1X supplicant software to a client or to provide other services
for unauthenticated clients.