802.1X With Acl Assignment Configuration Example - HP FlexNetwork 10500 Series Security Configuration Manual

802.1X with ACL assignment configuration example

Network requirements
As shown in
authentication to access the Internet.
Perform 802.1X authentication on GigabitEthernet 1/0/1. Use the RADIUS server at 10.1.1.1 as the
authentication and authorization server, and the RADIUS server at 10.1.1.2 as the accounting
server.
Configure ACL assignment on GigabitEthernet 1/0/1 to deny access of 802.1X users to the FTP
server from 8:00 to 18:00 on weekdays.
Figure 38 Network diagram
Host
192.168.1.10/24
Configuration procedure
1. Configure the 802.1X client. Make sure the client is able to update its IP address after the
access port is assigned to the 802.1X guest VLAN or an authorization VLAN. (Details not
shown.)
2. Configure the RADIUS servers to provide authentication, authorization, and accounting
services. Add user accounts and specify the ACL (ACL 3000 in this example) for the users.
(Details not shown.)
3. Assign an IP address to each interface, as shown in
4. Configure a RADIUS scheme:
# Create RADIUS scheme 2000 and enter RADIUS scheme view.
<Device> system-view
[Device] radius scheme 2000
# Specify the server at 10.1.1.1 as the primary authentication server, and set the authentication
port to 1812.
[Device-radius-2000] primary authentication 10.1.1.1 1812
# Specify the server at 10.1.1.2 as the primary accounting server, and set the accounting port to
1813.
[Device-radius-2000] primary accounting 10.1.1.2 1813
# Set the shared key to abc in plain text for secure communication between the authentication
server and the device.
[Device-radius-2000] key authentication simple abc
# Set the shared key to abc in plain text for secure communication between the accounting
server and the device.
[Device-radius-2000] key accounting simple abc
# Exclude the ISP domain names from the usernames sent to the RADIUS server.
Figure 38, the host that connects to GigabitEthernet 1/0/1 must pass 802.1X
RADIUS server cluster
GE1/0/2
GE1/0/3
GE1/0/1
Vlan-int2
192.168.1.1/24
Device
Auth: 10.1.1.1
Acct: 10.1.1.2
Internet
105
FTP server
10.0.0.1/24
Figure 38. (Details not shown.)