HPE FlexNetwork 10500 Series Security Configuration Manual page 597

•
Configure the 802.1X client feature, so that the switch acts as an 802.1X client and can use
802.1X-generated CAKs for MAcsec.
Figure 161 Network diagram
VLAN 2
VLAN 3
Configuration procedure
1. Configure IP addresses for the Ethernet ports. Make sure the switch, the device, and the
RADIUS server can reach one another. (Details not shown.)
2. Configure the access device. (Details not shown.)
Configuration on the access device varies by manufacturer. For information about device
configuration, see the corresponding product manual. This part illustrates only the switch
configuration, and for information about 802.1X client commands, see Security Command
Reference.
3. Configure the RADIUS server to provide authentication, authorization, and accounting services.
Add user accounts. (Details not shown.)
4. Configure the switch:
# Create VLAN 2.
<Switch> system-view
[Switch] vlan 2
[Switch-vlan2] quit
# Configure GigabitEthernet 1/0/2 as a trunk port, and assign the port to VLAN 2.
[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] port link-type trunk
[Switch-GigabitEthernet1/0/2] port trunk permit vlan 2
# Configure the 802.1X client username as aaaa, and set the password to 123456 in plaintext
form on GigabitEthernet 1/0/2.
[Switch-GigabitEthernet1/0/2] dot1x supplicant username aaaa
[Switch-GigabitEthernet1/0/2] dot1x supplicant password simple 123456
# Specify TTLS-GTC as the 802.1X client EAP authentication method on GigabitEthernet 1/0/2.
[Switch-GigabitEthernet1/0/2] dot1x supplicant eap-method ttls-gtc
# Specify MAC address 1-1-1 for 802.1X client authentication on GigabitEthernet 1/0/2.
[Switch-GigabitEthernet1/0/2] dot1x supplicant mac-address 1-1-1
# Enable the 802.1X client feature on GigabitEthernet 1/0/2.
[Switch-GigabitEthernet1/0/2] dot1x supplicant enable
# Configure MACsec desire and enable MKA on GigabitEthernet 1/0/2.
[Switch-GigabitEthernet1/0/2] macsec desire
GE1/0/2 Permit: VLAN 1,2
GE1/0/3 Permit: VLAN 1,3
Switch
(802.1X Client)
Device RADIUS server
580