HP Q.11. (2510-24) Manual do Utilizador descarregar pdf (Página 188)

8-4

Configuring Port-Based and Client-Based Access Control (802.1X)

Overview

Port-Based access control option allowing authentication by a single client to

open the port. This option does not force a client limit and, on a port opened

by an authenticated client, allows unlimited client access without requiring

further authentication.

• Supplicant implementation using CHAP authentication and indepen-

dent username and password configuration on each port.

■ Prevention of traffic flow in either direction on unauthorized ports.

■ Local authentication of 802.1X clients using the switch’s local user-

name and password (as an alternative to RADIUS authentication).

■ Temporary on-demand change of a port’s VLAN membership status

to support a current client’s session. (This does not include ports that

are members of a trunk.)

■ Session accounting with a RADIUS server, including the accounting

update interval.

■ Use of Show commands to display session counters.

User Authentication Methods

The switch offers two methods for using 802.1X access control. Generally, the

“Port Based” method supports one 802.1X-authenticated client on a port,

which opens the port to an unlimited number of clients. The “Client-Based”

method supports up to two 802.1X-authenticated clients on a port. In both

cases, there are operating details to be aware of that can influence your choice

of methods.

802.1X Client-Based Access Control

802.1X operation with access control on a per-client basis provides client-level

security that allows LAN access to individual 802.1X clients (up to 2 per port),

where each client gains access to the LAN by entering valid user credentials.

This operation improves security by opening a given port only to individually

authenticated clients, while simultaneously blocking access to the same port

for clients that cannot be authenticated. All sessions must use the same

untagged VLAN. Also, an authenticated client can use any tagged VLAN

memberships statically configured on the port, provided the client is config-

ured to use the tagged VLAN memberships available on the port.

1 2 ... 183 184 185 186 187 188 189 190 191 192 193 ... 293 294

Sem comentários

HP Q.11. (2510-24) Manual do Utilizador Página 188