Configuration Procedure - HP 5920 Series Configuration Manual

Use RADIUS servers to perform authentication, authorization, and accounting for the 802.1X users. If
RADIUS authentication fails, perform local authentication on the access device.
Configure the host at 10.1.1.1/24 as the primary authentication and accounting servers, and the host at
10.1.1.2/24 as the secondary authentication and accounting servers. Assign all users to the ISP domain
aabbcc.net.
Configure the shared key as name for packets between the access device and the authentication server,
and the shared key as money for packets between the access device and the accounting server.
Figure 31 Network diagram
Supplicant
Host
192.168.1.2/24

Configuration procedure

Configure the 802.1X client. If HP iNode is used, do not select the Carry version info option in the
1.
client configuration. (Details not shown.)
Configure the RADIUS servers and add user accounts for the 802.1X users. (Details not shown.)
2.
For information about the RADIUS commands used on the access device in this example, see
Security Command Reference.
Assign an IP address for each interface on the access device. (Details not shown.)
3.
Configure user accounts for the 802.1X users on the access device:
4.
# Add a local network access user with the username localuser, and password localpass in
plaintext. (Make sure the username and password are the same as those configured on the
RADIUS server.)
<Device> system-view
[Device] local-user localuser class network
[Device-luser-network-localuser] password simple localpass
# Set the service type to lan-access.
[Device-luser-network-localuser] service-type lan-access
[Device-luser-network-localuser] quit
# Configure the idle cut function to log off any online user that has been idle for 20 minutes.
[Device-luser-localuser] authorization-attribute idle-cut 20
[Device-luser-localuser] quit
Configure a RADIUS scheme:
5.
# Create the RADIUS scheme radius1 and enter its view.
[Device] radius scheme radius1
# Specify the IP addresses of the primary authentication and accounting RADIUS servers.
XGE1/0/2
Authenticator
10.1.1.10/24
XGE1/0/1
Vlan-int2
192.168.1.1/24
Device
RADIUS server cluster
Primary: 10.1.1.1/24
Secondary: 10.1.1.2/24
Internet
72