Guest Vlan And Authorization Vlan Configuration Example - HP MSR Series Configuration Manual

NOTE:
The access device must use the same username format as the RADIUS server. If the RADIUS
server includes the ISP domain name in the username, so must the access device.
6. Configure the ISP domain:
# Create an ISP domain named bbb and enter its view.
[Device] domain bbb
# Apply the RADIUS scheme radius1 to the ISP domain, and specify local authentication as the
secondary authentication method.
[Device-isp-bbb] authentication lan-access radius-scheme radius1 local
[Device-isp-bbb] authorization lan-access radius-scheme radius1 local
[Device-isp-bbb] accounting lan-access radius-scheme radius1 local
[Device-isp-bbb] quit
7. Configure 802.1X:
# Enable 802.1X on GigabitEthernet 2/0/1.
[Device] interface gigabitethernet 2/0/1
[Device-GigabitEthernet2/0/1] dot1x
# Enable MAC-based access control on the port. By default, the port uses MAC-based access
control.
[Device-GigabitEthernet2/0/1] dot1x port-method macbased
# Specify the ISP domain bbb as the mandatory domain.
[Device-GigabitEthernet2/0/1] dot1x mandatory-domain bbb
[Device-GigabitEthernet2/0/1] quit
# Enable 802.1X globally.
[Device] dot1x
Verifying the configuration
# Verify the 802.1X configuration on GigabitEthernet 2/0/1.
[Device] display dot1x interface gigabitethernet 2/0/1
# Display the user connection information after an 802.1X user passes authentication.
[Device] display dot1x connection
802.1X guest VLAN and authorization VLAN configuration
example
Network requirements
As shown in
accounting for 802.1X users who connect to GigabitEthernet 2/0/2. Implement port-based access
control on the port.
Configure VLAN 10 as the 802.1X guest VLAN on GigabitEthernet 2/0/2. The host and the update
server are both in VLAN 10, and the host can access the update server and download the 802.1X
client software.
After the host passes 802.1X authentication, the access device assigns the host to VLAN 5 where
GigabitEthernet 2/0/3 is. The host can access the Internet.
Figure 40, use RADIUS servers to perform authentication, authorization, and
108