802.1X With Acl Assignment Configuration Example - HPE FlexNetwork 5510 HI Series Security Configuration Manual

Verifying the configuration
# Verify the 802.1X guest VLAN configuration on GigabitEthernet 1/0/2.
[Device] display dot1x interface gigabitethernet 1/0/2
# Verify that GigabitEthernet 1/0/2 is assigned to VLAN 10 when no user passes authentication on
the port.
[Device] display vlan 10
# After a user passes authentication, display information on GigabitEthernet 1/0/2. Verify that
GigabitEthernet 1/0/2 is assigned to VLAN 5.
[Device] display interface gigabitethernet 1/0/2

802.1X with ACL assignment configuration example

Network requirements
As shown in
authentication to access the Internet.
Perform 802.1X authentication on GigabitEthernet 1/0/1. Use the RADIUS server at 10.1.1.1 as the
authentication and authorization server, and the RADIUS server at 10.1.1.2 as the accounting
server.
Configure ACL assignment on GigabitEthernet 1/0/1 to deny access of 802.1X users to the FTP
server from 8:00 to 18:00 on weekdays.
Figure 33 Network diagram
Host
192.168.1.10/24
Configuration procedure
1. Configure the 802.1X client. Make sure the client is able to update its IP address after the
access port is assigned to the 802.1X guest VLAN or an authorization VLAN. (Details not
shown.)
2. Configure the RADIUS servers to provide authentication, authorization, and accounting
services. Add user accounts and specify the ACL (ACL 3000 in this example) for the users.
(Details not shown.)
3. Assign an IP address to each interface, as shown in
4. Configure a RADIUS scheme:
# Create RADIUS scheme 2000 and enter RADIUS scheme view.
<Device> system-view
[Device] radius scheme 2000
# Specify the server at 10.1.1.1 as the primary authentication server, and set the authentication
port to 1812.
[Device-radius-2000] primary authentication 10.1.1.1 1812
Figure 33, the host that connects to GigabitEthernet 1/0/1 must pass 802.1X
RADIUS server cluster
GE1/0/2
GE1/0/3
GE1/0/1
Vlan-int2
192.168.1.1/24
Device
Auth: 10.1.1.1
Acct: 10.1.1.2
Internet
98
FTP server
10.0.0.1/24
Figure 33. (Details not shown.)