HPE FlexNetwork 10500 Series Security Configuration Manual page 4

802.1X-related protocols ·································································································································· 85
Packet formats ········································································································································· 85
EAP over RADIUS ··································································································································· 86
802.1X authentication initiation ························································································································ 87
802.1X client as the initiator ····················································································································· 87
Access device as the initiator ··················································································································· 87
802.1X authentication procedures ··················································································································· 88
Comparing EAP relay and EAP termination ····························································································· 88
EAP relay ················································································································································· 89
EAP termination ······································································································································· 90
Configuring 802.1X ······················································································ 92
Access control methods ··································································································································· 92
802.1X VLAN manipulation ······························································································································ 92
Authorization VLAN ·································································································································· 92
Guest VLAN ············································································································································· 94
Auth-Fail VLAN ········································································································································ 96
Critical VLAN ············································································································································ 97
Critical voice VLAN ·································································································································· 98
802.1X VSI manipulation·································································································································· 99
802.1X support for VXLANs ····················································································································· 99
Authorization VSI ··································································································································· 100
Guest VSI ··············································································································································· 100
Auth-Fail VSI ·········································································································································· 100
Critical VSI ············································································································································· 101
Using 802.1X authentication with other features···························································································· 101
ACL assignment ····································································································································· 101
EAD assistant ········································································································································· 102
Redirect URL assignment ······················································································································ 103
802.1X configuration restrictions and guidelines···························································································· 103
Configuration prerequisites ···························································································································· 103
802.1X configuration task list ························································································································· 104
Enabling 802.1X ············································································································································· 104
Enabling EAP relay or EAP termination ········································································································· 105
Setting the port authorization state ················································································································ 106
Specifying an access control method············································································································· 106
Setting the maximum number of concurrent 802.1X users on a port ····························································· 106
Setting the maximum number of authentication request attempts ································································· 107
Setting the 802.1X authentication timeout timers ·························································································· 107
Configuring online user handshake················································································································ 108
Configuration restrictions and guidelines ······························································································· 108
Configuration procedure ························································································································· 108
Configuring the authentication trigger feature ································································································ 109
Configuration restrictions and guidelines ······························································································· 109
Configuration procedure ························································································································· 109
Specifying a mandatory authentication domain on a port ·············································································· 109
Setting the quiet timer ···································································································································· 110
Configuring 802.1X reauthentication ·············································································································· 110
Overview ················································································································································ 110
Configuration restrictions and guidelines ······························································································· 110
Configuring 802.1X periodic reauthentication ························································································ 111
Configuring 802.1X manual reauthentication ························································································· 111
Enabling the keep-online feature ··········································································································· 111
Configuring an 802.1X guest VLAN ··············································································································· 112
Configuration restrictions and guidelines ······························································································· 112
Configuration prerequisites ···················································································································· 112
Configuration procedure ························································································································· 113
Enabling 802.1X guest VLAN assignment delay···························································································· 113
Configuring an 802.1X Auth-Fail VLAN·········································································································· 114
Configuration restrictions and guidelines ······························································································· 114
Configuration prerequisites ···················································································································· 114
Configuration procedure ························································································································· 114
ii