HP PROCURVE 2910AL, Access Security Manual

Page: 86 / 594

Web and MAC Authentication
Overview
Overview
Feature Default Menu CLI Web
Configure Web Authentication n/a — 3-18 —
Configure MAC Authentication n/a — 3-32 —
Display Web Authentication Status and Configuration n/a — 3-26 —
Display MAC Authentication Status and Configuration n/a — 3-36 —
Web and MAC authentication are designed for employment on the “edge” of
a network to provide port-based security measures for protecting private
networks and a switch from unauthorized access. Because neither method
requires clients to run special supplicant software (unlike 802.1X authentica­
tion), both Web and MAC authentication are suitable for legacy systems and
temporary access situations where introducing supplicant software is not an
attractive option. Only a web browser (for Web authentication) or a MAC
address (for MAC authentication) is required.
Both Web and MAC authentication methods rely on a RADIUS server to
authenticate network access. This simplifies access security management by
allowing you to control access from a master database in a single server. (You
can use up to three RADIUS servers to provide backups in case access to the
primary server fails.) It also means the same credentials can be used for
authentication, regardless of which switch or switch port is the current access
point into the LAN.
On a port configured for Web or MAC Authentication, the switch operates as
a port-access authenticator using a RADIUS server and the CHAP protocol.
Inbound traffic is processed by the switch alone, until authentication occurs.
Some traffic from the switch to an unauthorized client is supported (for
example, broadcast or unknown destination packets) before authentication
occurs.
Web Authentication
The Web Authentication (Web-Auth) method uses a web page login to authen­
ticate users for access to the network. When a client connects to the switch
and opens a web browser, the switch automatically presents a login page.
3-2