HP ProCurve 2510G Series, Руководство пользователя

Страница: 202 / 320

8-4
Configuring Port-Based and Client-Based Access Control (802.1X)
Overview
cated clients per-port.
• Port-Based access control option allowing authentication by a single
client to open the port. This option does not force a client limit and,
on a port opened by an authenticated client, allows unlimited client
access without requiring further authentication.
• Supplicant implementation using CHAP authentication and indepen-
dent username and password configuration on each port.
■ Prevention of traffic flow in either direction on unauthorized ports.
■ Local authentication of 802.1X clients using the switch’s local user-
name and password (as an alternative to RADIUS authentication).
■
Temporary on-demand change of a port’s VLAN membership status
to support a current client’s session. (This does not include ports that
are members of a trunk.)
■ Session accounting with a RADIUS server, including the accounting
update interval.
■ Use of Show commands to display session counters.
User Authentication Methods
The switch offers two methods for using 802.1X access control. Generally, the
“Port Based” method supports one 802.1X-authenticated client on a port,
which opens the port to an unlimited number of clients. The “Client-Based”
method supports up to two 802.1X-authenticated clients on a port. In both
cases, there are operating details to be aware of that can influence your choice
of methods.
802.1X Client-Based Access Control
802.1X operation with access control on a per-client basis provides client-level
security that allows LAN access to individual 802.1X clients (up to 2 per port),
where each client gains access to the LAN by entering valid user credentials.
This operation improves security by opening a given port only to individually
authenticated clients, while simultaneously blocking access to the same port
for clients that cannot be authenticated. All sessions must use the same
untagged VLAN. Also, an authenticated client can use any tagged VLAN
memberships statically configured on the port, provided the client is config-
ured to use the tagged VLAN memberships available on the port.