ProCurve 2610 Manual page 171

Note
Client's Username (802.1X or Web Authentication)
mobile011 Auth-Type:= Local, User-Password == run101112
HP-IP-FILTER-RAW = "permit in tcp from any to 10.10.10.101",
HP-IP-FILTER-RAW += "deny in tcp from any to any",
HP-IP-FILTER-RAW += "permit in ip from any to any"
Client's Username (MAC Authentication)
08E99C4F0019 Auth-Type:= Local, User-Password == 08E99C4F0019
HP-IP-FILTER-RAW = "permit in tcp from any to 10.10.10.101",
HP-IP-FILTER-RAW += "deny in tcp from any to any",
HP-IP-FILTER-RAW += "permit in ip from any to any"
Figure 6-5. Example of Configuring the FreeRADIUS Server To Support ACLs for the Indicated Clients
vation of system resources, and remember that every ACL you create
automatically includes an implicit deny in ip from any to any ACE. For
example, suppose that you wanted to create identical ACL support for the
following:
• a client having a username of "mobile011" and a password of
"run101112"
• a client having a MAC address of 08 E9 9C 4F 00 19
The ACL in this example must achieve the following:
• permit http (TCP port 80) traffic from the client to the device at
10.10.10.101
• deny http (TCP port 80) traffic from the client to all other devices
• permit all other traffic from the client to all other devices
To configure the above ACL, you would enter the username/password and
ACE information shown in figure6-5 into the FreeRADIUS users file.
For syntax details on dynamic port ACLs, refer to the next section, "Format
Details for ACEs Configured in a Dynamic Port ACL".
Note that when the client MAC address is used for authentication, this address is used
in both the username and password spaces in the entry.
Format Details for ACEs Configured in a Dynamic Port ACL.
Configuring RADIUS Server Support for Switch Services
Configuring and Using RADIUS-Assigned Access Control Lists
Client's Password (802.1X or Web Authentication)
Client's Password (MAC Authentication)
6-17