User Authentication Methods - HP Q.11. (2510-24) Access Security Manual

Configuring Port-Based and Client-Based Access Control (802.1X)
Overview
8-4
Port-Based access control option allowing authentication by a single client to
open the port. This option does not force a client limit and, on a port opened
by an authenticated client, allows unlimited client access without requiring
further authentication.
• Supplicant implementation using CHAP authentication and indepen-
dent username and password configuration on each port.
■ Prevention of traffic flow in either direction on unauthorized ports.
Local authentication of 802.1X clients using the switch's local user-
■
name and password (as an alternative to RADIUS authentication).
Temporary on-demand change of a port's VLAN membership status
■
to support a current client's session. (This does not include ports that
are members of a trunk.)
Session accounting with a RADIUS server, including the accounting
■
update interval.
■ Use of Show commands to display session counters.

User Authentication Methods

The switch offers two methods for using 802.1X access control. Generally, the
"Port Based" method supports one 802.1X-authenticated client on a port,
which opens the port to an unlimited number of clients. The "Client-Based"
method supports up to two 802.1X-authenticated clients on a port. In both
cases, there are operating details to be aware of that can influence your choice
of methods.
802.1X Client-Based Access Control
802.1X operation with access control on a per-client basis provides client-level
security that allows LAN access to individual 802.1X clients (up to 2 per port),
where each client gains access to the LAN by entering valid user credentials.
This operation improves security by opening a given port only to individually
authenticated clients, while simultaneously blocking access to the same port
for clients that cannot be authenticated. All sessions must use the same
untagged VLAN. Also, an authenticated client can use any tagged VLAN
memberships statically configured on the port, provided the client is config-
ured to use the tagged VLAN memberships available on the port.