98
802.1X with ACL assignment configuration example
Network requirements
As shown in
, the host that connects to FortyGigE 1/1/1 must pass 802.1X authentication to
access the Internet.
Perform 802.1X authentication on FortyGigE 1/1/1. Use the RADIUS server at 10.1.1.1 as the
authentication and authorization server, and the RADIUS server at 10.1.1.2 as the accounting
server.
Configure ACL assignment on FortyGigE 1/1/1 to deny access of 802.1X users to the FTP server
from 8:00 to 18:00 on weekdays.
Figure 33 Network diagram
Configuration procedure
1.
Configure the 802.1X client. Make sure the client is able to update its IP address after the
access port is assigned to the 802.1X guest VLAN or an authorization VLAN. (Details not
shown.)
2.
Configure the RADIUS servers to provide authentication, authorization, and accounting
services. Add user accounts and specify the ACL (ACL 3000 in this example) for the users.
(Details not shown.)
3.
Assign an IP address to each interface, as shown in
4.
Configure a RADIUS scheme:
# Create RADIUS scheme
2000
and enter RADIUS scheme view.
<Device> system-view
[Device] radius scheme 2000
# Specify the server at 10.1.1.1 as the primary authentication server, and set the authentication
port to 1812.
[Device-radius-2000] primary authentication 10.1.1.1 1812
# Specify the server at 10.1.1.2 as the primary accounting server, and set the accounting port to
1813.
[Device-radius-2000] primary accounting 10.1.1.2 1813
# Set the shared key to
abc
in plain text for secure communication between the authentication
server and the device.
[Device-radius-2000] key authentication simple abc
# Set the shared key to
abc
in plain text for secure communication between the accounting
server and the device.
[Device-radius-2000] key accounting simple abc
# Exclude the ISP domain name from the usernames sent to the RADIUS server.
Internet
Device
Host
RADIUS server cluster
192.168.1.10/24
FGE1/1/2
FTP server
10.0.0.1/24
Auth:10.1.1.1
Acct:10.1.1.2
Vlan-int2
192.168.1.1/24
FGE1/1/3
FGE1/1/1
