HP HP ProCurve Series 6600, Руководство по обеспечению безопасности доступа

Страница: 338 / 778

7-20
Configuring RADIUS Server Support for Switch Services
Configuring and Using Dynamic (RADIUS-Assigned) Access Control Lists
actual IP traffic inbound from any client on the switch carries a source MAC
address unique to that client. The RADIUS-assigned ACL uses this MAC
address to identify the traffic to be filtered.)
Effect of Multiple ACL Application Types on an Interface. The switch
allows simultaneous use of all supported ACL application types on an inter-
face. Thus, a static ACL assigned to an interface filters authenticated client
traffic, regardless of whether a RADIUS-assigned ACL is also filtering the
client’s traffic. For more information, refer to “Multiple ACLs on an Interface”
on page 10-19.
General ACL Features, Planning, and Configuration
These steps suggest a process for using RADIUS-assigned ACLs to establish
access policies for client IP traffic.
1. Determine the polices you want to enforce for authenticated client traffic
inbound on the switch.
2. Plan ACLs to execute traffic policies:
• Apply ACLs on a per-client basis where individual clients need differ-
ent traffic policies or where each client must have a different user-
name/password pair or will authenticate using MAC authentication.
• Apply ACLs on a client group basis where all clients in a given group
can use the same traffic policy and the same username/password pair.
3. Configure the ACLs on a RADIUS server accessible to the intended clients.
4. Configure the switch to use the desired RADIUS server and to support the
desired client authentication scheme. Options include 802.1X, Web
authentication, or MAC authentication. (Note that the switch supports the
option of simultaneously using 802.1X with either Web or MAC authenti-
cation.)
5. Test client access on the network to ensure that your RADIUS-assigned
ACL application is properly enforcing your policies.
For further information common to all IPv4 or IPv6 ACL applications, refer to
the latest versions of the following manuals for your switch:
Chapter Title Manual
IPv4 Access Control Lists Access Security Guide
IPv6 Access Control Lists IPv6 Configuration Guide