HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

89
• If MAC-based access control is used, the port sends a unicast Identity EAP/Request to the
802.1X user to trigger authentication.
• If port-based access control is used, the port sends a multicast Identity EAP/Request to the
802.1X users to trigger authentication.
ACL assignment
The following matrix shows the feature and hardware compatibility:
Hardware Feature compatibility
MSR900 No
MSR93X No
MSR20-1X No
MSR20 No
MSR30 Supported only on MSR30-11E and MSR30-11F
MSR50 No
MSR1000 No
You can specify an ACL for an 802.1X user to control its access to network resources. After the user
passes 802.1X authentication, the authentication server, either the local access device or a RADIUS
server, assigns the ACL to the port to filter the traffic from this user. In either case, you must configure
the ACL on the access device. You can change ACL rules while the user is online.
Configuration prerequisites
• Configure an ISP domain and AAA scheme (local or RADIUS authentication) for 802.1X users.
• If RADIUS authentication is used, create user accounts on the RADIUS server.
• If local authentication is used, create local user accounts on the access device and set the
service type to lan-access.
For information about RADIUS client configuration, see "Configuring AAA."
802.1X configuration task list
Task Remarks
Enabling 802.1X
Required.
Enabling EAP relay or EAP termination
Optional.
Setting the port authorization state
Optional.
Specifying an access control method
Optional.
Setting the maximum number of concurrent 802.1X users on a port
Optional.
Setting the maximum number of authentication request attempts
Optional.
Setting the 802.1X authentication timeout timers
Optional.
Configuring the online user handshake function
Optional.
Enabling the proxy detection function
Optional.

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English