HP ProCurve 2510-24, Руководство пользователя

Страница: 202 / 318

8-6
Configuring Port-Based and Client-Based Access Control (802.1X)
Overview
access from a master database in a single server (although you can use up to
three RADIUS servers to provide backups in case access to the primary server
fails). It also means a user can enter the same username and password pair
for authentication, regardless of which switch is the access point into the LAN.
Note that you can also configure 802.1X for authentication through the
switch’s local username and password instead of a RADIUS server, but doing
so increases the administrative burden, decentralizes username/password
administration, and reduces security by limiting authentication to one Oper-
ator/Manager password set for all users.
Providing a Path for Downloading 802.1X Supplicant Software. For
clients that do not have the necessary 802.1X supplicant software, there is also
the option to configure the 802.1X Open VLAN mode. This mode allows you
to assign such clients to an isolated VLAN through which you can provide the
necessary supplicant software these clients need to begin the authentication
process. (Refer to “802.1X Open VLAN Mode” on page 8-26.)
Authenticating One Switch to Another. 802.1X authentication also
enables the switch to operate as a supplicant when connected to a port on
another switch running 802.1X authentication.
Figure 8-1. Example of an 802.1X Application
Accounting . The switch also provides RADIUS Network accounting for
802.1X access. Refer to “RADIUS Authentication, Authorization and Account-
ing” on page 5-1.
RADIUS Server
LAN Core
802.1X-Aware
Client
(Supplicant)
Switch Running 802.1X and
Connected as a Supplicant
Switch Running 802.1X and
Operating as an Authenticator