R3303-HP HSR6800 Routers Security Configuration Guide

98
Task Command Remarks
Display 802.1X session
information, statistics, or
configuration information of
specified or all ports.
display dot1x [ sessions | statistics ] [ interface
interface-list ] [ | { begin | exclude | include }
regular-expression ]
Available in any view.
Clear 802.1X statistics. reset dot1x statistics [ interface interface-list ] Available in user view.
802.1X authentication configuration example
Network requirements
As shown in Figure 37, the Router performs 802.1X authentication for users that connect to port
GigabitEthernet 3/0/1. Implement MAC-based access control on the port, so the logoff of one user does
not affect other online 802.1X users.
Use RADIUS servers to perform authentication, authorization, and accounting for the 802.1X users. If
RADIUS authentication fails, perform local authentication on the Router. If RADIUS accounting fails, the
Router logs the user off.
Configure the host at 10.1.1.1/24 as the primary authentication and accounting servers, and the host at
10.1.1.2/24 as the secondary authentication and accounting servers. Assign all users to the ISP domain
aabbcc.net, which accommodates up to 30 users.
Configure the shared key as name for packets between the Router and the authentication server, and the
shared key as money for packets between the Router and the accounting server.
Figure 37 Network diagram
Configuration procedure
1. Configure the 802.1X client. If HP iNode is used, do not select the Carry version info option in the
client configuration. (Details not shown.)
2. Configure the RADIUS servers and add user accounts for the 802.1X users. (Details not shown.)
For information about the RADIUS commands used on the Router in this example, see Security
Command Reference.
3. Assign an IP address for each interface on the Router. (Details not shown.)