background image

Operation Manual – 802.1x and System Guard 
H3C S3100-52P Ethernet switch 

Table of Contents

 

Table of Contents 

Chapter 1 802.1x Configuration ................................................................................................... 1-1

 

1.1 Introduction to 802.1x ........................................................................................................ 1-1

 

1.1.1 Architecture of 802.1x Authentication ..................................................................... 1-2

 

1.1.2 The Mechanism of an 802.1x Authentication System............................................. 1-3

 

1.1.3 Encapsulation of EAPoL Messages ........................................................................ 1-4

 

1.1.4 802.1x Authentication Procedure ............................................................................ 1-7

 

1.1.5 Timers Used in 802.1x .......................................................................................... 1-10

 

1.1.6 802.1x Implementation on an S3100-52P Switch ................................................. 1-11

 

1.2 Introduction to 802.1x Configuration................................................................................ 1-15

 

1.3 Basic 802.1x Configuration.............................................................................................. 1-16

 

1.3.1 Configuration Prerequisites................................................................................... 1-16

 

1.3.2 Configuring Basic 802.1x Functions...................................................................... 1-16

 

1.3.3 Timer and Maximum User Number Configuration ................................................ 1-18

 

1.4 Advanced 802.1x Configuration....................................................................................... 1-20

 

1.4.1 Configuring Proxy Checking.................................................................................. 1-20

 

1.4.2 Configuring Client Version Checking .................................................................... 1-21

 

1.4.3 Enabling DHCP-triggered Authentication.............................................................. 1-22

 

1.4.4 Configuring Guest VLAN....................................................................................... 1-22

 

1.4.5 Configuring 802.1x Re-Authentication .................................................................. 1-23

 

1.4.6 Configuring the 802.1x Re-Authentication Timer .................................................. 1-23

 

1.5 Displaying and Maintaining 802.1x Configuration ........................................................... 1-24

 

1.6 Configuration Example .................................................................................................... 1-24

 

1.6.1 802.1x Configuration Example .............................................................................. 1-24

 

Chapter 2 Quick EAD Deployment Configuration...................................................................... 2-1

 

2.1 Introduction to Quick EAD Deployment ............................................................................. 2-1

 

2.1.1 Quick EAD Deployment Overview .......................................................................... 2-1

 

2.1.2 Operation of Quick EAD Deployment...................................................................... 2-1

 

2.2 Configuring Quick EAD Deployment.................................................................................. 2-2

 

2.2.1 Configuration Prerequisites..................................................................................... 2-2

 

2.2.2 Configuration Procedure ......................................................................................... 2-2

 

2.2.3 Displaying and Maintaining Quick EAD Deployment .............................................. 2-4

 

2.3 Quick EAD Deployment Configuration Example ............................................................... 2-4

 

2.4 Troubleshooting ................................................................................................................. 2-5

 

Chapter 3 HABP Configuration ...................................................................................................3-1

 

3.1 Introduction to HABP ......................................................................................................... 3-1

 

3.2 HABP Server Configuration ............................................................................................... 3-1

 

3.3 HABP Client Configuration ................................................................................................ 3-2

 

Содержание S3100-52P

Страница 1: ...oxy Checking 1 20 1 4 2 Configuring Client Version Checking 1 21 1 4 3 Enabling DHCP triggered Authentication 1 22 1 4 4 Configuring Guest VLAN 1 22 1 4 5 Configuring 802 1x Re Authentication 1 23 1 4...

Страница 2: ...4 1 4 1 System Guard Overview 4 1 4 1 1 Guard Against IP Attacks 4 1 4 1 2 Guard Against TCN Attacks 4 1 4 1 3 Layer 3 Error Control 4 1 4 2 Configuring System Guard 4 1 4 2 1 Configuring System Guar...

Страница 3: ...anced 802 1x Configuration z Displaying and Maintaining 802 1x Configuration z Configuration Example 1 1 Introduction to 802 1x The 802 1x protocol 802 1x for short was developed by IEEE802 LAN WAN co...

Страница 4: ...he authenticator system is another entity residing at one end of a LAN segment It authenticates the connected supplicant systems The authenticator system is usually an 802 1x supported network device...

Страница 5: ...In this case no packets can pass through it z Controlled port and uncontrolled port are two properties of a port Packets reaching a port are visible to both the controlled port and uncontrolled port...

Страница 6: ...ses the information about the supplicant system to the authenticator system The authenticator system in turn determines the state authorized or unauthorized of the controlled port according to the ins...

Страница 7: ...licant system and the authenticator system EAP packets are encapsulated by RADIUS protocol to allow them successfully reach the authentication servers Network management related information such as al...

Страница 8: ...RADIUS protocol packet for EAP authentication Refer to the Introduction to RADIUS protocol section in the AAA Operation for information about the format of a RADIUS protocol packet The EAP message fie...

Страница 9: ...ty and Protected Extensible Authentication Protocol PEAP are available in the EAP relay mode z EAP MD5 authenticates the supplicant system The RADIUS server sends MD5 keys contained in EAP request MD5...

Страница 10: ...client to initiate an access request by sending an EAPoL start packet to the switch with its user name and password provided The 802 1x client program then forwards the packet to the switch to start...

Страница 11: ...allow the supplicant system to access the network z The supplicant system can also terminate the authenticated state by sending EAPoL Logoff packets to the switch The switch then changes the port sta...

Страница 12: ...at in the EAP relay mode except that the randomly generated key in the EAP terminating mode is generated by the switch and that it is the switch that sends the user name the randomly generated key and...

Страница 13: ...em if the switch does not receive the response from the supplicant system when this timer times out z Transmission timer tx period This timer sets the tx period and is triggered by the switch in two c...

Страница 14: ...but sends no Trap packets z Sends Trap packets without disconnecting the supplicant system This function needs the cooperation of 802 1x client and a CAMS server z The 802 1x client needs to be capabl...

Страница 15: ...ables supplicant systems that are not authenticated to upgrade their 802 1x client programs With this function enabled z The switch sends authentication triggering request EAP Request Identity packets...

Страница 16: ...username and password any more z An authentication server running CAMS authenticates the username and password during re authentication of a user in the EAP authentication mode but does not in PAP or...

Страница 17: ...AA scheme Local authentication RADIUS scheme 802 1x configuration Figure 1 11 802 1x configuration z 802 1x users use domain names to associate with the ISP domains configured on switches z Configure...

Страница 18: ...02 1x is disabled globally In system view dot1x interface interface list interface interface type interface number dot1x Enable 802 1x for specified ports In port view quit Required By default 802 1x...

Страница 19: ...entication method chap pap eap Optional By default a switch performs CHAP authentication in EAP terminating mode Enable online user handshaking dot1x handshake enable Optional By default online user h...

Страница 20: ...or not a user is online z As clients that are not of H3C do not support the online user handshaking function switches cannot receive handshake acknowledgement packets from them in handshaking periods...

Страница 21: ...default Set 802 1x timers dot1x timer handshake period handshake period value quiet period quiet period value server timeout server timeout value supp timeout supp timeout value tx period tx period v...

Страница 22: ...ecting and so on z Client version checking configuration z DHCP triggered authentication z Guest VLAN configuration z 802 1x re authentication configuration z Configuration of the 802 1x re authentica...

Страница 23: ...tch too by using the dot1x version check command 1 4 2 Configuring Client Version Checking Follow these steps to configure client version checking To do Use the command Remarks Enter system view syste...

Страница 24: ...mic IP addresses through DHCP Follow these steps to enable DHCP triggered authentication To do Use the command Remarks Enter system view system view Enable DHCP triggered authentication dot1x dhcp lau...

Страница 25: ...In port view dot1x re authenticate Required By default 802 1x re authentication is disabled on a port Note z To enable 802 1x re authentication on a port you must first enable 802 1x globally and on t...

Страница 26: ...value of the Session timeout attribute field as the re authentication interval The following introduces how to configure the 802 1x re authentication timer on the switch Follow these steps to configu...

Страница 27: ...11 1 1 operates as the primary authentication server and the secondary accounting server The other operates as the secondary authentication server and primary accounting server The password for the s...

Страница 28: ...n IP addresses to the primary authentication and accounting RADIUS servers Sysname radius radius1 primary authentication 10 11 1 1 Sysname radius radius1 primary accounting 10 11 1 2 Assign IP address...

Страница 29: ...ver is invalid specify to adopt the local authentication scheme Sysname isp aabbcc net scheme radius scheme radius1 local Specify the maximum number of users the user domain can accommodate to 30 Sysn...

Страница 30: ...s the forcible deployment of EAD clients with 802 1x authentication easing the work of EAD client deployment 2 1 2 Operation of Quick EAD Deployment Quick EAD deployment is achieved with the two funct...

Страница 31: ...2 1x on the switch z Set the access mode to auto for 802 1x enabled ports 2 2 2 Configuration Procedure I Configuring a free IP range A free IP range is an IP range that users can access before passin...

Страница 32: ...upport port security The configured free IP range cannot take effect if you enable port security II Setting the ACL timeout period The quick EAD deployment function depends on ACLs in restricting acce...

Страница 33: ...Quick EAD Deployment Configuration Example I Network requirements A user connects to the switch directly The switch connects to the Web server and the Internet The user will be redirected to the Web s...

Страница 34: ...than the dotted decimal notation the user may not be redirected This is related with the operating system used on the PC In this case the PC considers the IP address string a name and tries to resolve...

Страница 35: ...802 1x authentications when traveling between HABP enabled switches through which management devices can obtain the MAC addresses of the attached switches and thus the management of the attached swit...

Страница 36: ...HABP server to send HABP request packets is 20 seconds 3 3 HABP Client Configuration HABP clients reside on switches attached to HABP servers After you enable HABP for a switch the switch operates as...

Страница 37: ...ion Manual 802 1x and System Guard H3C S3100 52P Ethernet switch Chapter 3 HABP Configuration 3 3 To do Use the command Remarks Display statistics on HABP packets display habp traffic Available in any...

Страница 38: ...ding packets for that host z If the packets from the infected host need processing by the CPU the switch decreases the precedence of such packets and discards the packets already delivered to the CPU...

Страница 39: ...d is 30 record times threshold is 1 and isolate time is 3 Note The correlations among the arguments of the system guard ip detect threshold command can be clearly described with this example If you se...

Страница 40: ...10 second monitoring cycle the system will not send trap or log information in the next 10 second monitoring cycle 4 2 3 Enabling Layer 3 Error Control Follow these steps to enable Layer 3 error contr...

Отзывы: