Enabling Eap Relay Or Eap Termination; Setting The Port Authorization State - HP FlexNetwork 10500 Series Security Configuration Manual

Enabling EAP relay or EAP termination

When configuring EAP relay or EAP termination, consider the following factors:
•
Support of the RADIUS server for EAP packets.
•
Authentication methods supported by the 802.1X client and the RADIUS server.
You can use both EAP termination and EAP relay in any of the following situations:
•
The client is using only MD5-Challenge EAP authentication.
•
The client is using only the username and password EAP authentication initiated by an HPE
iNode 802.1X client.
To use EAP-TL, PEAP, or any other EAP authentication methods, you must use EAP relay. When
you make your decision, see
For more information about EAP relay and EAP termination, see
procedures."
To configure EAP relay or EAP termination:
Step
1. Enter system
view.
2. Configure EAP
relay or EAP
termination.
NOTE:
If EAP relay mode is used, the user-name-format command configured in RADIUS scheme view
does not take effect. The access device sends the authentication data from the client to the server
without any modification.

Setting the port authorization state

The port authorization state determines whether the client is granted access to the network. You can
control the authorization state of a port by using the dot1x port-control command and the following
keywords:
•
authorized-force—Places the port in the authorized state, enabling users on the port to access
the network without authentication.
•
unauthorized-force—Places the port in the unauthorized state, denying any access requests
from users on the port.
•
auto—Places the port initially in unauthorized state to allow only EAPOL packets to pass. After
a user passes authentication, sets the port in the authorized state to allow access to the
network. You can use this option in most scenarios.
To set the authorization state of a port:
Step
1. Enter system view.
"Comparing EAP relay and EAP
Command
system-view
dot1x
authentication-method
{ chap | eap | pap }
Command
system-view
86
termination" for help.
Remarks
N/A
By default, the access device performs EAP
termination and uses CHAP to communicate with
the RADIUS server.
Specify the eap keyword to enable EAP relay.
Specify the chap or pap keyword to enable
CHAP-enabled or PAP-enabled EAP termination.
Remarks
N/A
"802.1X authentication