Huawei Quidway S2700 Series Configuration Manual page 7

Quidway S2700 Series Ethernet Switches
Configuration Guide - Security
2.3.1 Establishing the Configuration Task.......................................................................................................50
2.3.2 Enabling Global 802.1x Authentication..................................................................................................51
2.3.3 Enabling 802.1x Authentication on an Interface.....................................................................................51
2.3.4 (Optional) Enabling MAC Bypass Authentication..................................................................................52
2.3.5 Setting the Authentication Method for the 802.1x User..........................................................................53
2.3.6 (Optional) Configuring the Interface Access Mode................................................................................54
2.3.7 (Optional) Configuring the Authorization Status of an Interface............................................................55
2.3.8 (Optional) Setting the Maximum Number of Concurrent Access Users.................................................56
2.3.9 (Optional) Enabling DHCP Packets to Trigger Authentication..............................................................57
2.3.10 (Optional) Configuring 802.1x Timers..................................................................................................57
2.3.11 (Optional) Configuring the Quiet Timer Function................................................................................58
2.3.12 (Optional) Configuring 802.1x Re-authentication.................................................................................59
2.3.13 (Optional) Configuring the Guest VLAN for 802.1x Authentication...................................................60
2.3.14 (Optional) Enabling the S2700 to Send Handshake Packets to Online Users.......................................61
2.3.15 (Optional) Setting the Retransmission Count of the Authentication Request.......................................61
2.3.16 Checking the Configuration...................................................................................................................62
2.4 Configuring MAC Address Authentication......................................................................................................63
2.4.1 Establishing the Configuration Task.......................................................................................................63
2.4.2 Enabling Global MAC Address Authentication......................................................................................64
2.4.3 Enabling MAC Address Authentication on an Interface.........................................................................64
2.4.4 Configuring a User Name for MAC Address Authentication.................................................................65
2.4.5 (Optional) Configuring the Domain for MAC Address Authentication..................................................66
2.4.6 (Optional) Setting the Timers of MAC Address Authentication.............................................................66
2.4.7 (Optional) Configuring the Guest VLAN for MAC Address Authentication.........................................67
2.4.8 (Optional) Setting the Maximum Number of Access Users Who Adopt MAC Address Authentication
..........................................................................................................................................................................68
2.4.9 (Optional) Re-Authenticating a User with the Specified MAC Address................................................69
2.4.10 Checking the Configuration...................................................................................................................69
2.5 Maintaining NAC.............................................................................................................................................70
2.5.1 Clearing the Statistics About 802.1x Authentication..............................................................................70
2.5.2 Clearing Statistics About MAC Address Authentication........................................................................70
2.6 Configuration Examples...................................................................................................................................71
2.6.1 Example for Configuring the RADIUS Server to Deliver Authorization ACL......................................71
3 DHCP Snooping Configuration...............................................................................................74
3.1 Introduction to DHCP Snooping......................................................................................................................76
3.2 DHCP Snooping Features Supported by the S2700.........................................................................................76
3.3 Preventing the Bogus DHCP Server Attack.....................................................................................................78
3.3.1 Establishing the Configuration Task.......................................................................................................78
3.3.2 Enabling DHCP Snooping.......................................................................................................................78
3.3.3 Configuring an Interface as a Trusted Interface......................................................................................80
3.3.4 (Optional) Enabling Detection of Bogus DHCP Servers........................................................................80
3.3.5 Checking the Configuration.....................................................................................................................81
Issue 01 (2011-07-15) Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
Contents
vi