Configuration Guidelines; Configuration Procedure; Specifying A Mandatory Authentication Domain On A Port - HP 6600 Security Configuration Manual

Configuration guidelines

Follow these guidelines when you configure the authentication trigger function:
• Enable the multicast trigger on a port when the clients attached to the port cannot send EAPOL-Start
packets to initiate 802.1X authentication.
Enable the unicast trigger on a port if only a few 802.1X clients are attached to the port and these
•
clients cannot initiate authentication.
• To avoid duplicate authentication packets, do not enable both triggers on a port.

Configuration procedure

To configure the authentication trigger function on a port:
Step
1. Enter system view.
2. Set the username
request timeout timer.
3. Enter Ethernet
interface view.
4. Enable an
authentication trigger.
Specifying a mandatory authentication domain on
a port
You can place all 802.1X users in a mandatory authentication domain for authentication, authorization,
and accounting on a port. No user can use an account in any other domain to access the network
through the port. The implementation of a mandatory authentication domain enhances the flexibility of
802.1X access control deployment.
To specify a mandatory authentication domain for a port:
Step
1. Enter system view.
2. Enter Ethernet interface view.
3. Specify a mandatory 802.1X
authentication domain on the
port.
Command
system-view
dot1x timer tx-period
tx-period-value
interface interface-type
interface-number
dot1x { multicast-trigger |
unicast-trigger }
Command
system-view
interface interface-type
interface-number
dot1x mandatory-domain
domain-name
94
Remarks
N/A
Optional.
The default setting is 30 seconds.
N/A
Required if you want to enable the unicast trigger.
By default, the multicast trigger is enabled, and the
unicast trigger is disabled.
Remarks
N/A
N/A
By default, no mandatory 802.1X
authentication domain is specified.