HPE FlexFabric 5940 SERIES, Руководство по настройке безопасности

Страница: 109 / 571

96
Feature Relationship description Reference
Port intrusion protection
actions on a port that
performs MAC-based
access control
The 802.1X guest VLAN feature has higher
priority than the block MAC action.
The 802.1X guest VLAN feature has lower
priority than the shutdown port action of the
port intrusion protection feature.
See " Configuring port
security ."
Configuration prerequisites
Before you configure an 802.1X guest VLAN, complete the following tasks:
•
Create the VLAN to be specified as the 802.1X guest VLAN.
•
If the 802.1X-enabled port performs MAC-based access control, perform the following
operations for the port:
{
Configure the port as a hybrid port.
{
Enable MAC-based VLAN on the port. For more information about MAC-based VLANs, see
Layer 2—LAN Switching Configuration Guide .
{
Assign the port to the 802.1X guest VLAN as an untagged member.
Configuration procedure
To configure an 802.1X guest VLAN:
Step Command Remarks
1. Enter system view.
system-view
N/A
2. Enter Ethernet interface
view.
interface interface-type
interface-number
N/A
3. Configure the 802.1X guest
VLAN on the port.
dot1x guest-vlan guest-vlan-id
By default, no 802.1X guest VLAN
exists.
Enabling 802.1X guest VLAN assignment delay
This feature delays assigning an 802.1X-enabled port to the 802.1X guest VLAN when 802.1X
authentication is triggered on the port.
This feature applies only to situations where 802.1X authentication is triggered by EAPOL-Start
packets from 802.1X clients or packets from unknown MAC addresses.
To use this feature, the 802.1X-enabled port must perform MAC-based access control.
When 802.1X authentication is triggered on a port, the device performs the following operations:
1. Sends a unicast EAP-Request/Identity packet to the MAC address that triggers the
authentication.
2. Retransmits the packet if no response is received within the username request timeout interval
set by using the
dot1x timer tx-period command.
3. Assigns the port the 802.1X guest VLAN after the maximum number of request attempts set by
using the
dot1x retry command is reached.
To enable 802.1X guest VLAN assignment delay on a port: