Specifying An 802.1X Client Eap Authentication Method; Configuring An 802.1X Client Anonymous Identifier - HPE FlexNetwork 10500 Series Security Configuration Manual

Specifying an 802.1X client EAP authentication
method
An 802.1X client-enabled device supports the following EAP authentication methods:
•
MD5-Challenge.
•
PEAP-MSCHAPv2.
•
PEAP-GTC.
•
TTLS-MSCHAPv2.
•
TTLS-GTC.
An 802.1X authenticator supports both the EAP relay and EAP termination modes. Support of the
EAP authentication methods for the two modes varies.
•
The MD5-Challenge EAP authentication supports both modes.
•
Other EAP authentication methods support only the EAP relay mode.
For information about EAP relay and EAP termination, see
To specify an 802.1X client EAP authentication method on an interface:
Step
1. Enter system view.
2. Enter Ethernet interface
view.
3. Specify an 802.1X client
EAP authentication
method.

Configuring an 802.1X client anonymous identifier

At the first authentication phase, packets sent to the authenticator are not encrypted. The use of an
802.1X client anonymous identifier prevents the 802.1X client username from being disclosed at the
first phase. The 802.1X client-enabled device sends the anonymous identifier to the authenticator
instead of the 802.1X client username. The 802.1X client username will be sent to the authenticator
in encrypted packets at the second phase.
If no 802.1X client anonymous identifier is configured, the device sends the 802.1X client username
at the first authentication phase.
The configured 802.1X client anonymous identifier takes effect only if one of the following EAP
authentication methods is used:
•
PEAP-MSCHAPv2.
•
PEAP-GTC.
•
TTLS-MSCHAPv2.
•
TTLS-GTC.
If the MD5-Challenge EAP authentication is used, the configured 802.1X client anonymous identifier
does not take effect. The device uses the 802.1X client username at the first authentication phase.
Command
system-view
interface interface-type
interface-number
dot1x supplicant eap-method
{ md5 | peap-gtc |
peap-mschapv2 | ttls-gtc |
ttls-mschapv2 }
590
"Configuring 802.1X."
Remarks
N/A
N/A
By default, an 802.1X client-enabled
interface uses the MD5-Challenge
EAP authentication.
Make sure the specified 802.1X
client EAP authentication method is
supported by the authentication
server.