HP PROCURVE 2910AL, Access Security Manual

Page: 228 / 594

Configuring RADIUS Server Support for Switch Services
Configuring and Using RADIUS-Assigned Access Control Lists
1. Enter the ProCurve vendor-specific ID and the ACL VSA in the
FreeRADIUS
dictionary
file:
VENDOR HP 11
ProCurve (HP) Vendor-Specific ID
BEGIN-VENDOR HP
ATTRIBUTE HP-IP-FILTER-RAW 61 STRING
END-VENDOR HP
ProCurve (HP) Vendor-Specific
Attribute for RADIUS-assigned ACLs
Note that if you were also using the RADIUS server to
administer 802.1p (CoS) priority, you would also insert the
ATTRIBUTE entries for these functions above the END­
VENDOR entry.
Figure 6-4. Example of Configuring the VSA for RADIUS-assigned ACLs in a FreeRADIUS Server
2. Enter the switch IP address, NAS (Network Attached Server) type, and
the key in the FreeRADIUS clients.conf file. For example, if the switch IP
address is 10.10.10.125 and the key is “1234”, you would enter the follow­
ing in the server’s
clients.conf file:
client 10.10.18.12
Note: The key configured in the switch and the secret configured in
nastype = other
the RADIUS server supporting the switch must be identical. Refer to
secret = 1234
the chapter titled “RADIUS Authentication and Accounting” in the
Access Security Guide for your switch.
Figure 6-5. Example of Configuring the Switch’s Identity Information in a FreeRADIUS Server
3. For a given client username/password pair or MAC address, create an ACL
by entering one or more ACEs in the FreeRADIUS “users” file. Enter the
ACEs in an order that promotes optimum traffic management and conser­
vation of system resources, and remember that every ACL you create
automatically includes an implicit
deny in ip from any to any
ACE. For
example, suppose that you wanted to create identical ACL support for the
following:
• a client having a username of “mobile011” and a password of
“run101112”
• a client having a MAC address of 08 E9 9C 4F 00 19
The ACL in this example must achieve the following:
• permit http (TCP port 80) traffic from the client to the device at
10.10.10.101
• deny http (TCP port 80) traffic from the client to all other devices
• permit all other traffic from the client to all other devices
To configure the above ACL, you would enter the username/password and
ACE information shown in figure6-6 into the FreeRADIUS
users file.
6-22