HPE FlexNetwork 10500 Series Security Configuration Manual page 6

Configuration prerequisites ···························································································································· 144
General guidelines and restrictions ················································································································ 144
Configuration task list ····································································································································· 145
Enabling MAC authentication ························································································································· 145
Specifying a MAC authentication domain ······································································································ 146
Configuring the user account format ·············································································································· 146
Configuring MAC authentication timers·········································································································· 147
Setting the maximum number of concurrent MAC authentication users on a port ········································· 147
Enabling MAC authentication multi-VLAN mode on a port ············································································ 147
Configuring MAC authentication delay ··········································································································· 148
Enabling parallel processing of MAC authentication and 802.1X authentication ··········································· 148
Configuration restrictions and guidelines ······························································································· 149
Configuration procedure ························································································································· 149
Configuring a MAC authentication guest VLAN ····························································································· 149
Configuration prerequisites ···················································································································· 149
Configuration restrictions and guidelines ······························································································· 150
Configuration procedure ························································································································· 150
Configuring a MAC authentication critical VLAN ···························································································· 150
Enabling the MAC authentication critical voice VLAN ···················································································· 151
Configuration prerequisites ···················································································································· 151
Configuration procedure ························································································································· 152
Configuring a MAC authentication guest VSI ································································································· 152
Configuration restrictions and guidelines ······························································································· 152
Configuration prerequisites ···················································································································· 152
Configuration procedure ························································································································· 152
Configuring a MAC authentication critical VSI ······························································································· 153
Configuration restrictions and guidelines ······························································································· 153
Configuration prerequisites ···················································································································· 153
Configuration procedure ························································································································· 153
Configuring periodic MAC reauthentication···································································································· 153
Overview ················································································································································ 153
Configuration restrictions and guidelines ······························································································· 154
Configuration procedure ························································································································· 154
Including user IP addresses in MAC authentication requests ········································································ 155
Enabling MAC authentication offline detection ······························································································ 156
Enabling logging for MAC authentication users ····························································································· 156
Overview ················································································································································ 156
Configuration restrictions and guidelines ······························································································· 156
Configuration procedure ························································································································· 156
Displaying and maintaining MAC authentication ···························································································· 156
MAC authentication configuration examples ·································································································· 157
Local MAC authentication configuration example ·················································································· 157
RADIUS-based MAC authentication configuration example ·································································· 159
ACL assignment configuration example ································································································· 161
MAC authentication authorization VSI assignment configuration example ············································ 164
Configuring portal authentication ······························································· 167
Overview ························································································································································ 167
Extended portal functions ······················································································································· 167
Portal system components ····················································································································· 167
Portal system using the local portal Web server ···················································································· 169
Interaction between portal system components ····················································································· 169
Portal authentication modes ··················································································································· 170
Portal support for EAP ··························································································································· 170
Portal authentication process ················································································································· 171
Portal filtering rules ································································································································ 173
MAC-based quick portal authentication ································································································· 173
Portal configuration task list ··························································································································· 174
Configuration prerequisites ···························································································································· 175
Configuring a portal authentication server ····································································································· 175
Configuring a portal Web server ···················································································································· 176
Enabling portal authentication ························································································································ 177
iv