Configuring 802.1X; Access Control Methods; 802.1X Vlan Manipulation; Authorization Vlan - HP FlexNetwork 10500 Series Security Configuration Manual

Configuring 802.1X

This chapter describes how to configure 802.1X on an HPE device. You can also configure the port
security feature to perform 802.1X. Port security combines and extends 802.1X and MAC
authentication. It applies to a network that requires different authentication methods for different
users on a port. For more information about the port security feature, see

Access control methods

Hewlett Packard Enterprise implements port-based access control as defined in the 802.1X protocol,
and extends the protocol to support MAC-based access control.
•
Port-based access control—Once an 802.1X user passes authentication on a port, any
subsequent user can access the network through the port without authentication. When the
authenticated user logs off, all other users are logged off.
•
MAC-based access control—Each user is separately authenticated on a port. When a user
logs off, no other online users are affected.

802.1X VLAN manipulation

Authorization VLAN

You can specify authorization VLANs for an 802.1X user to control access to authorized network
resources. When the 802.1X user passes authentication, the authentication server assigns the
authorization VLANs or VLAN group to the users.
Supported VLAN types and forms
Which VLAN types and forms are supported depends on the authorization type.
•
Local VLAN authorization.
You can specify only one authorization VLAN by its ID in user view or user group view on the
access device. For more information about local user configuration, see
•
Remote VLAN authorization.
You can specify a VLAN or a group of VLANs on the AAA server for 802.1X users. The access
device supports VLANs of the following forms:
VLAN ID.
VLAN name.
The VLAN name represents the VLAN description on the access device.
Combination of VLAN IDs and VLAN names.
In the string, some VLANs are represented by their IDs, and some VLANs are represented
by their names.
VLAN group name.
For more information about VLAN groups, see Layer 2—LAN Switching Configuration
Guide.
VLAN ID with suffix.
The suffix can be t or u, which indicates whether the ports assigned to the VLAN are tagged
members or not. For example, 2u indicates that the ports assigned to VLAN 2 are untagged
members.
76
"Configuring port security."
"Configuring AAA."