Configuring 802.1X; Access Control Methods; 802.1X Vlan Manipulation; Authorization Vlan - HPE Moonshot 45Gc Security Configuration Manual

Configuring 802.1X

This chapter describes how to configure 802.1X on an HPE device. You can also configure the port
security feature to perform 802.1X. Port security combines and extends 802.1X and MAC
authentication. It applies to a network that requires different authentication methods for different
users on a port. For more information about the port security feature, see "Configuring port security."

Access control methods

Hewlett Packard Enterprise implements port-based access control as defined in the 802.1X protocol,
and extends the protocol to support MAC-based access control.
•
Port-based access control—Once an 802.1X user passes authentication on a port, any
subsequent user can access the network through the port without authentication. When the
authenticated user logs off, all other users are logged off.
•
MAC-based access control—Each user is separately authenticated on a port. When a user
logs off, no other online users are affected.

802.1X VLAN manipulation

Authorization VLAN

The device uses authorization VLANs to control the access of 802.1X users to authorized network
resources. The authorization VLAN of an 802.1X user can be specified on the local device or be
assigned by a remote server..
Supported VLAN types and forms
Support for VLAN types and forms depends on the authorization type.
•
Local VLAN authorization.
The authorization VLAN of an 802.1X user is in the form of VLAN ID that is specified in user
view or user group view on the device. The port through which the user accesses the device is
assigned to the VLAN as an untagged member.
For more information about local user configuration, see "Configuring AAA."
•
Remote VLAN authorization.
The authorization VLAN information of an 802.1X user is assigned by a remote server. The
device resolves the VLAN information and selects a VLAN as the authorization VLAN for the
user. The port through which the user accesses the device can be assigned to the VLAN as a
tagged or untagged member.
The device can resolve server-assigned VLANs in the following forms:
VLAN ID.
VLAN name.
The VLAN name represents the VLAN description on the access device.
Combination of VLAN IDs and VLAN names.
In the string, some VLANs are represented by their IDs, and some VLANs are represented
by their names.
VLAN group name.
For more information about VLAN groups, see Layer 2—LAN Switching Configuration
Guide.
72