HP 3600 v2 Series Security Configuration Manual page 204

NOTE:
Make sure that the terminals, the server, and the switch can reach each other.
•
• The host of the web user must have a route to the listening IP address of the local portal server.
Configure the RADIUS server, and make sure the authentication, authorization, and accounting
1.
functions work normally. In this example, configure on the RADIUS server an 802.1X user (with
username userdot), a portal user (with username userpt), and a MAC authentication user (with a
username and password both being the MAC address of the printer 001588f80dd7).
Configure portal authentication.
2.
# Configure VLANs and IP addresses for the VLAN interfaces, and add ports to specific VLANs. (Details
not shown)
# Configure the local portal server to support HTTP.
<Switch> system-view
[Switch] portal local-server http
# Configure the IP address of interface loopback 12 as 4.4.4.4.
[Switch] interface loopback 12
[Switch-LoopBack12] ip address 4.4.4.4 32
[Switch-LoopBack12] quit
# Specify the listening IP address of the local portal server for Layer-2 portal authentication as 4.4.4.4.
[Switch] portal local-server ip 4.4.4.4
# Enable Layer-2 portal authentication on Ethernet 1/0/1.
[Switch] interface ethernet 1/0/1
[Switch–Ethernet1/0/1] portal local-server enable
[Switch–Ethernet1/0/1] quit
Configure 802.1X authentication.
3.
# Enable 802.1X authentication globally.
[Switch] dot1x
# Enable 802.1X authentication (MAC-based access control required) on Ethernet 1/0/1.
[Switch] interface ethernet 1/0/1
[Switch–Ethernet1/0/1] dot1x port-method macbased
[Switch–Ethernet1/0/1] dot1x
[Switch–Ethernet1/0/1] quit
Configure MAC authentication.
4.
# Enable MAC authentication globally.
[Switch] mac-authentication
# Enable MAC authentication on Ethernet 1/0/1.
[Switch] interface ethernet 1/0/1
[Switch–Ethernet1/0/1] mac-authentication
[Switch–Ethernet1/0/1] quit
Configure a RADIUS scheme.
5.
# Create a RADIUS scheme named rs1.
[Switch] radius scheme rs1
# Specify the server type for the RADIUS scheme, which must be extended when the iMC server is used.
193