HP FlexFabric 5700 series, Руководство по настройке безопасности

Страница: 83 / 460

71
Configuring 802.1X
This chapter describes how to configure 802.1X on an HP device. You can also configure the port security
feature to perform 802.1X. Port security combines and extends 802.1X and MAC authentication. It
applies to a network that requires different authentication methods for different users on a port. For more
information about the port security feature, see "
Configuring port security . "
Access control methods
HP implements port-based access control as defined in the 802.1X protocol, and extends the protocol to
support MAC-based access control.
• Port-based access control —Once an 802.1X user passes authentication on a port, any subsequent
user can access the network through the port without authentication. When the authenticated user
logs off, all other users are logged off.
•
MAC-based access control —Each user is separately authenticated on a port. When a user logs off,
no other online users are affected.
802.1X VLAN manipulation
Authorization VLAN
You can specify authorization VLANs for an 802.1X user to control access to authorized network
resources. When the 802.1X user passes authentication, the authentication server assigns the
authorization VLANs or VLAN group to the user.
Supported VLAN types and forms
Support for VLAN types and forms depends on the authorization type.
•
Local VLAN authorization.
You can specify only one authorization VLAN by its ID in user view or user group view on the
access device. For more information about local user configuration, see "
Configuring AAA ."
•
Remote VLAN authorization.
You can specify a VLAN or a group of VLANs on the AAA server for 802.1X users. The access
device supports VLANs of the following forms:
{
VLAN ID.
{
VLAN name.
The VLAN name represents the VLAN description on the access device.
{
Combination of VLAN IDs and VLAN names.
In the string, some VLANs are represented by their IDs, and some VLANs are represented by
their names.
{
VLAN group name.
For more information about VLAN groups, see
Layer 2—LAN Switching Configuration Guide .