HP PROCURVE 2910AL, Руководство по обеспечению безопасности доступа

Страница: 304 / 594

IPv4 Access Control Lists (ACLs)
Overview
802.1X User-Based and Port-Based Applications. User-Based 802.1X
access control allows up to 8 individually authenticated clients on a given port.
However, port-based access control does not set a client limit, and requires
only one authenticated client to open a given port (and is recommended for
applications where only one client at a time can connect to the port).
■
If you configure 802.1X
user-based
security on a port and the RADIUS
response includes a dynamic port ACL for at least one authenticated
client, then the RADIUS response for all other clients authenticated
on the port must also include a dynamic port ACL. Traffic on the port
from any client that authenticates without the RADIUS server
including a dynamic port ACL in its response will be dropped and the
client will be de-authenticated.
■ Using 802.1X port-based security on a port where the RADIUS
response includes a dynamic port ACL, only the first client to authen­
ticate can use the port. Traffic from other clients will be dropped.
Multiple ACLs on an Interface
Multiple ACL Assignments Allowed. The switch allows multiple ACL
applications on an interface (subject to internal resource availability). This
means that a port can simultaneously be subject to the following:
■
One static port ACL for any IPv4 traffic entering the switch on the
port.
■ One dynamic (RADIUS-assigned) port ACL applied to inbound IPv4
traffic for each authenticated client on the port
Features Common to All ACL Applications
■ Any ACL can have multiple entries (ACEs).
■ You can apply any one ACL to multiple interfaces.
■ All ACEs in an ACL configured on the switch are automatically
sequenced (numbered). For an existing ACL, entering an ACE without
specifying a sequence number automatically places the ACE at the
end of the list. Specifying a sequence number inserts the ACE into the
list at the correct sequential location.
• Automatic sequence numbering begins with “10” and increases in
increments of 10. You can renumber the ACEs in an ACL and also
change the sequence increment between ACEs.
9-16