Authentication - HP MSM317 Deployment Manual

Authentication

The MSM7xx provides three methods for authorizing IP phones on the MSM317: 802.1X
authentication, MAC address filtering, and MAC authentication. Configuring MAC filtering is the least
complex of these methods and is therefore recommended on the MSM317.
MAC address filtering lets you control port access based on client station MAC addresses. On the
MSM317, authorization is handled by the unit itself, and settings are defined on a per-port basis. Lists
of addresses that are permitted to transmit and receive are set at the port level. For each list, you
assign a global name that helps you identify it.
The controller allows you to apply various masks to a given list so that you can filter on a single
address, a range of addresses, or a group of devices, such as those from a certain vendor. Once you
have created your lists, you can specify which lists are allowed to access the port.
Authorizing IP end devices adds security to VoIP deployments but requires careful coordination of
installation and configuration to avoid problems. For example, if you configure MAC address filtering
on an MSM317 switch port and then attempt to install end devices prior to setting up the MAC
address list, the phones cannot pass traffic. It is recommended that you deploy the phones first and
then enable MAC address filtering.
Figure 13: To configure MAC filtering, use the controller to create lists of MAC addresses permitted to send and receive traffic
on an MSM317 switch port. You then specify these lists in the MAC filter area of the port configuration page for the port you
want to configure.
Note:
For instructions on configuring 802.1X authentication, MAC address
filtering, and MAC authentication on an MSM317 switch port, see the
HP MSM317 Access Device Installation and Getting Started Guide, the
section on configuring the switch ports. Also see the HP MSM7xx
Controllers Management and Configuration Guide, the chapter on user
authentication, accounts, and addressing.
17