Triple Authentication Supporting Vlan Assignment And Auth-Fail Vlan Configuration Example - HP 5500 HI Series Configuration Manual

[Switch] domain triple
# Configure the default AAA methods for all types of users in the domain.
[Switch-isp-triple] authentication default radius-scheme rs1
[Switch-isp-triple] authorization default radius-scheme rs1
[Switch-isp-triple] accounting default radius-scheme rs1
[Switch-isp-triple] quit
# Configure domain triple as the default domain. If a username input by a user includes no ISP
domain name, the authentication scheme of the default domain is used.
[Switch] domain default enable triple
Verifying the configuration
User userdot uses the 802.1X client to initiate authentication. After inputting the correct username and
password, the user can pass 802.1X authentication. Web user userpt uses a web browser to access an
external network.
http://4.4.4.4/portal/logon.htm. After inputting the correct username and password, the web user can
pass portal authentication. The printer can pass MAC authentication after being connected to the
network.
Use the display connection command to view online users.
[Switch] display connection
Slot: 1
Index=30
IP=192.168.1.2
IPv6=N/A
MAC=0015-e9a6-7cfe
Index=31
IP=192.168.1.3
IPv6=N/A
MAC=0002-0002-0001
Index=32
IP=192.168.1.4
IPv6=N/A
MAC=0015-88f8-0dd7
Total 3 connection(s) matched on slot 1.
Total 3 connection(s) matched.
Triple authentication supporting VLAN assignment and
Auth-Fail VLAN configuration example
Network requirement
As shown in
authentication on the Layer-2 interface of the switch which connects to the terminals so that a terminal
passing one of the three authentication methods, 802.1X authentication, portal authentication, and MAC
authentication, can access the IP network.
Portal terminals use DHCP to get IP addresses in 192.168.1.0/24 before authentication and in
•
3.3.3.0/24 after passing authentication.
The web
, Username=userpt@triple
, Username=userdot@triple
, Username=001588f80dd7@triple
Figure 72, the terminals are connected to a switch to access the IP network. Configure triple
request is redirected
189
to the authentication page