Enabling The Proxy Detection Function; Configuring The Authentication Trigger Function - HP 6600 Security Configuration Manual

Enabling the proxy detection function

The proxy detection function prevents users from using an authenticated 802.1X client as a network
access proxy to bypass monitoring and accounting. When a user is detected accessing the network
through a proxy, the network access device can send traps to the network management system or log the
user off by sending an offline message.
Before you enable the proxy detection function, complete the following tasks:
Enable the online user handshake function (see
•
• Deploy HP iNode client software in your network.
To configure the proxy detection function:
Step
1. Enter system view.
2. Enable the proxy detection
function globally.
3. Enable the proxy detection
function on one or more ports
in system view or Ethernet
interface view.
NOTE:
If you configure the proxy detection function for a port in both system view and interface view, the setting
configured the last takes effect.

Configuring the authentication trigger function

The authentication trigger function enables the network access device to initiate 802.1X authentication
when 802.1X clients cannot initiate authentication.
This function provides the following types of authentication trigger:
Multicast trigger—Periodically multicasts Identity EAP-Request packets out of a port to detect 802.1X
•
clients and trigger authentication.
• Unicast trigger—Enables the network device to initiate 802.1X authentication when it receives a
data frame from an unknown source MAC address. The device sends a unicast Identity
EAP/Request packet to the unknown source MAC address, and retransmits the packet if it has
received no response within a period of time. This process continues until the maximum number of
request attempts set with the dot1x retry command (see
authentication request
The identity request timeout timer sets both the identity request interval for the multicast trigger and the
identity request timeout interval for the unicast trigger.
Command
system-view
dot1x supp-proxy-check { logoff | trap }
•
In system view:
dot1x supp-proxy-check { logoff | trap }
interface interface-list
•
In Ethernet interface view:
a. interface interface-type
interface-number
b. dot1x supp-proxy-check { logoff |
trap }
attempts") is reached.
93
"Configuring the online user handshake
"Setting the maximum number of
function").
Remarks
N/A
By default, the
function is disabled.
By default, the
function is disabled.