Switch 7700 Configuration Guide

ManualsBrandsHP ManualsComputer AccessoriesHP ProCurve Switch Gigabit-LX Module

191

192

193

194

195

196

197

198

199

200

184 CHAPTER 9: AAA AND RADIUS OPERATION

A server group, consisting of two RADIUS servers at 10.11.1.1 and 10.11.1.2

respectively, is connected to the switch. The former one acts as the

primary-authentication/second-accounting server. The latter one acts as the

secondary-authentication/primary-accounting server. Set the encryption key as

“name” when the system exchanges packets with the authentication RADIUS

server and “money” when the system exchanges packets with the accounting

RADIUS server. Configure the system to retransmit packets to the RADIUS server if

no response received in 5 seconds. Retransmit the packet no more than 5 times in

all. Configure the system to transmit a real-time accounting packet to the RADIUS

server every 15 minutes. The system is instructed to transmit the user name to the

RADIUS server after removing the user domain name.

The user name of the local 802.1x access user is localuser and the password is

localpass (input in plain text). The idle cut function is enabled.

Figure 2 Enabling 802.1x and RADIUS to Perform AAA on the Requester

The following examples concern most of the AAA/RADIUS configuration

commands. The configurations for accessing user workstation and the RADIUS

server are omitted.

1 Enable the 802.1x performance on the specified port Ethernet 1/0/2.

[SW7700] dot1x interface ethernet 1/0/2

2 Set the access control mode. (This command could not be configured, when it is

configured as MAC-based by default.)

[SW7700] dot1x port-method macbased interface ethernet 1/0/2

3 Create the RADIUS group radius1 and enters its configuration mode.

[SW7700] radius scheme radius1

4 Set the IP address of the primary authentication/accounting RADIUS servers.

[SW7700-radius-radius1] primary authentication 10.11.1.1

[SW7700-radius-radius1] primary accounting 10.11.1.2

5 Set the IP address of the second authentication/accounting RADIUS servers.

[SW7700-radius-radius1] secondary authentication 10.11.1.2

[SW7700-radius-radius1] secondary accounting 10.11.1.1

6 Set the encryption key when the system exchanges packets with the

authentication RADIUS server.

Internet

Authentication servers

(RADIUS server cluster

IP address: 10.11.1.1,

10.11.1.2)

Requestor

E1/0/2

Switch

Authenticator