To Next Page

To Previous Page

13-4

Configuring Port-Based and User-Based Access Control (802.1X)

Overview

■ If the first client authenticates and opens the port, and then one or more

other clients connect without trying to authenticate, then the port config-

uration as determined by the original RADIUS response remains

unchanged and all such clients will have the same access as the authenti-

cated client. When the authenticated client closes the session, the port

will also be closed to any other, unauthenticated clients that may have

also been using the port.

This operation unblocks the port while an authenticated client session is in

progress. In topologies where simultaneous, multiple client access is possible

this can allow unauthorized and unauthenticated access by another client

while an authenticated client is using the port. If you want to allow only

authenticated clients on the port, then user-based access control (page 13-3)

should be used instead of port-based access control. Using the user-based

method enables you to specify up to 32 authenticated clients.

Note Port-Based 802.1X can operate concurrently with Web-Authentication or

MAC-Authentication on the same port. However, this is not a commonly used

application and is not generally recommended. For more information, refer

to the operating note on page 13-12.

Alternative To Using a RADIUS Server

Note that you can also configure 802.1X for authentication through the

switch’s local username and password instead of a RADIUS server, but doing

so increases the administrative burden, decentralizes user credential admin-

istration, and reduces security by limiting authentication to one Operator

password set for all users.

Accounting

The switches covered in this guide also provide RADIUS Network accounting

for 802.1X access. Refer to chapter 6, “RADIUS-Administered CoS and Rate-

Limiting”.

HP ProCurve 6200yl Series User Manual

Other manuals for HP ProCurve 6200yl Series