HP 5120 SI Series Security Configuration Manual page 176

NOTE:
Make sure that the terminals, the server, and the switch can reach each other.
•
The host of the web user must have a route to the listening IP address of the local portal server.
•
Complete the configuration on the RADIUS server and make sure the authentication, authorization, and
•
accounting functions work normally. In this example, configure on the RADIUS server an 802.1X user
(with username userdot), a portal user (with username userpt), and a MAC authentication user (with a
username and password both being the MAC address of the printer 001588f80dd7).
1. Configure portal authentication
# Configure VLANs and IP addresses for the VLAN interfaces, and add ports to specific VLANs
(omitted).
# Configure the local portal server to support HTTP.
<Switch> system-view
[Switch] portal local-server http
# Configure the IP address of interface loopback 12 as 4.4.4.4.
[Switch] interface loopback 12
[Switch-LoopBack12] ip address 4.4.4.4 32
[Switch-LoopBack12] quit
# Specify the listening IP address of the local portal server for Layer-2 portal authentication as 4.4.4.4.
[Switch] portal local-server ip 4.4.4.4
# Enable Layer-2 portal authentication on GigabitEthernet 1/0/1.
[Switch] interface gigabitethernet 1/0/1
[Switch–GigabitEthernet1/0/1] portal local-server enable
[Switch–GigabitEthernet1/0/1] quit
2. Configure 802.1X authentication
# Enable 802.1X authentication globally.
[Switch] dot1x
# Enable 802.1X authentication (MAC-based access control required) on GigabitEthernet 1/0/1.
[Switch] interface gigabitethernet 1/0/1
[Switch–GigabitEthernet1/0/1] dot1x port-method macbased
[Switch–GigabitEthernet1/0/1] dot1x
[Switch–GigabitEthernet1/0/1] quit
3. Configure MAC authentication
# Enable MAC authentication globally.
[Switch] mac-authentication
# Enable MAC authentication on GigabitEthernet 1/0/1.
[Switch] interface gigabitethernet 1/0/1
[Switch–GigabitEthernet1/0/1] mac-authentication
[Switch–GigabitEthernet1/0/1] quit
4. Configure a RADIUS scheme
# Create a RADIUS scheme named rs1.
[Switch] radius scheme rs1
# Specify the server type for the RADIUS scheme, which must be extended when the iMC server is used.
164