The Packet-Filtering Process - HP E3800-24G-PoE+-2SFP+ Access Security Manual

Configuring RADIUS Server Support for Switch Services
Configuring and Using Dynamic (RADIUS-Assigned) Access Control Lists
Note
C a u t i o n
7-20

The Packet-filtering Process

Packet-Filtering in an applied ACL is sequential, from the first ACE in the ACL
to the implicit "deny any any" following the last explicit ACE. This operation
is the same regardless of whether the ACL is applied dynamically from a
RADIUS server or statically in the switch configuration.
If a RADIUS-assigned ACL permits an authenticated client's inbound IP
packet, but the client port is also configured with a static port ACL and/or
belongs to a VLAN for which there is an inbound, VLAN-based ACL configured
on the switch, then the packet will also be filtered by these other ACLs. If there
is a match with a deny ACE in any of these ACLs, the switch drops the packet.
ACLs can enhance network security by blocking selected IP traffic, and can
serve as one aspect of maintaining network security. However, because ACLs
do not provide user or device authentication, or protection from malicious
manipulation of data carried in IP packet transmissions, they should not
be relied upon for a complete security solution.
Operating Rules for RADIUS-Assigned ACLs
Relating a Client to a RADIUS-Assigned ACL: A RADIUS-
■
assigned ACL for a particular client must be configured in the RADIUS
server under the authentication credentials the server should expect
for that client. If the client must authenticate using 802.1X and/or Web
Authentication, the username/password pair forms the credential set.
If authentication is through MAC Authentication, then the client MAC
address forms the credential set. For more on this topic, refer to
"Configuring an ACL in a RADIUS Server" on page 7-22.
Multiple Clients Using the Same Username/Password Pair:
■
Multiple clients using the same username\password pair will use
duplicate instances of the same ACL.
Limits for ACEs in RADIUS-Assigned ACLs: The switch supports
■
up to 80 characters in a single ACE. Exceeding this limit causes the
related client authentication to fail.