HP Pavilion a6600, Руководство по настройке

Страница: 95 / 501

83
Enabling 802.1X
To do… Command… Remarks
1. Enter system view.
system-view —
2. Enable 802.1X globally.
dot1x
Required.
Disabled by default.
3. Enable
802.1X on
a port.
In system view dot1x interface interface-list
Required.
Use either approach.
Disabled by default.
In Ethernet
interface view
interface interface-type interface-
number
dot1x
NOTE:
•
If the default VLAN of a port is a voice VLAN, the 802.1X function cannot take effect on the port. For
more information about voice VLANs, see
Layer 2
—
LAN Switching Configuration Guide.
•
802.1X is mutually exclusive with link aggregation and service loopback group configuration on a
port.
Specifying an EAP message handling method
The IEEE 802.1X uses EAP to exchange authentication information between the client and the
authentication server. Configure the network access device to relay or terminate EAP packets:
•
EAP relay mode —The access device relays EAP messages between the client and the RADIUS
server. The EAP relay mode supports multiple EAP authentication methods, such as MD5-Challenge,
EAP-TL, and PEAP. To use this mode, you must make sure that RADIUS server supports the EAP-
Message and Message-Authenticator attributes and that it uses the same EAP authentication method
as the client. If EAP relay mode is used, the user-name-format command configured in RADIUS
scheme view does not take effect. The access device sends the authentication data from the client to
the server without any modification. For more information, see Security Command Reference .
•
EAP termination mode —The access device does not transmit EAP messages between the client and
the RADIUS server. Instead, it re-encapsulates and sends the authentication data from the client in
standard RADIUS packets to the RADIUS server and uses either CHAP or PAP to authenticate to the
RADIUS server. EAP termination with CHAP supports only MD5-Challenge.
For more information, see " 802.1X fundamentals ."
To specify an EAP message handling method for 802.1X authentication:
To do… Command… Remarks
1. Enter system view.
system-view —
2. Specify an EAP message
handling method.
dot1x authentication-method
{ chap | eap | pap }
Optional.
By default, the network access device
performs EAP termination and uses CHAP to
communicate with the RADIUS server.