ProCurve 6200yl User's Guide download pdf (Page 457)

13-5

Configuring Port-Based and User-Based Access Control (802.1X)

Overview

the session total includes any sessions begun by the Web Authentication or

MAC Authentication features covered in chapter 4.) For more information,

refer to “Option For Authenticator Ports: Configure Port-Security To Allow

Only 802.1X-Authenticated Devices” on page 13-42.

802.1X Port-Based Access Control

802.1X port-based access control provides port-level security that allows LAN

access only on ports where a single 802.1X-capable client (supplicant) has

entered authorized RADIUS user credentials. For reasons outlined below, this

option is recommended for applications where only one client at a time can

connect to the port. Using this option, the port processes all traffic as if it

comes from the same client. Thus, in a topology where multiple clients can

connect to the same port at the same time:

■ If the first client authenticates and opens the port, and then another client

authenticates, the port responds as if the original client has initiated a

reauthentication. With multiple clients authenticating on the port, the

RADIUS configuration response to the latest client authentication

replaces any other configuration from an earlier client authentication. If

all clients use the same configuration this should not be a problem. But if

the RADIUS server responds with different configurations for different

clients, then the last client authenticated will effectively lock out any

previously authenticated client. When any client to authenticate closes

its session, the port will also close and remain so until another client

successfully authenticates.

■ The most recent client authentication determines the untagged VLAN

membership for the port. Also, any client able to use the port can access

any tagged VLAN memberships statically configured on the port, provided

the client is configured to use the available, tagged VLAN memberships.

■ If the first client authenticates and opens the port, and then one or more

other clients connect without trying to authenticate, then the port config-

uration as determined by the original RADIUS response remains

unchanged and all such clients will have the same access as the authenti-

cated client. When the authenticated client closes the session, the port

will also be closed to any other, unauthenticated clients that may have

also been using the port.

This operation unblocks the port while an authenticated client session is in

progress. In topologies where simultaneous, multiple client access is possible

this can allow unauthorized and unauthenticated access by another client

while an authenticated client is using the port. If you want to allow only

authenticated clients on the port, then user-based access control (page 13-4)

should be used instead of port-based access control. Using the user-based

method enables you to specify up to 32 authenticated clients.

1 2 ... 452 453 454 455 456 457 458 459 460 461 462 ... 595 596

Comments to this Manuals

No comments

ProCurve 6200yl User's Guide Page 457

Comments to this Manuals

Related products and manuals for Network switches ProCurve 6200yl