HPE FlexFabric 5940 SERIES, Руководство по настройке безопасности

Страница: 92 / 571

79
Configuring 802.1X
This chapter describes how to configure 802.1X on an HPE device. You can also configure the port
security feature to perform 802.1X. Port security combines and extends 802.1X and MAC
authentication. It applies to a network that requires different authentication methods for different
users on a port. For more information about the port security feature, see "
Configuring port security ."
Access control methods
Hewlett Packard Enterprise implements port-based access control as defined in the 802.1X protocol,
and extends the protocol to support MAC-based access control.
•
Port-based access control —Once an 802.1X user passes authentication on a port, any
subsequent user can access the network through the port without authentication. When the
authenticated user logs off, all other users are logged off.
•
MAC-based access control —Each user is separately authenticated on a port. When a user
logs off, no other online users are affected.
802.1X VLAN manipulation
Authorization VLAN
The device uses the authorization VLAN to control the access of an 802.1X user to authorized
network resources.
Supported VLAN types and forms
Which VLAN types and forms are supported depends on the authorization type.
•
Local VLAN authorization.
The authorization VLAN of an 802.1X user is specified in user view or user group view in the
form of VLAN ID on the device. The port through which the user accesses the device is
assigned to the VLAN as an untagged member. Tagged VLAN assignment is not supported.
For more information about local user configuration, see " Configuring AAA ."
•
Remote VLAN authorization.
•
The authorization VLAN information of an 802.1X user is assigned by a remote server. The
device resolves the VLAN information and selects a VLAN as the authorization VLAN for the
user. The port through which the user accesses the device can be assigned to the VLAN as a
tagged or untagged member.
•
The access device can resolve server-assigned VLANs in the following forms:
{
VLAN ID.
{
VLAN name.
The VLAN name represents the VLAN description on the access device.
{
Combination of VLAN IDs and VLAN names.
In the string, some VLANs are represented by their IDs, and some VLANs are represented
by their names.
{
VLAN group name.
For more information about VLAN groups, see Layer 2—LAN Switching Configuration
Guide .
{
VLAN ID with suffix.