HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

91
• The client is an HPE iNode 802.1X client and initiates only the username and password EAP
authentication. If EAP termination is used, you can enable either PAP or CHAP authentication
on the access device. However, if the password is required to be transmitted in cipher text, you
must use CHAP authentication on the access device.
To use EAP-TL, PEAP, or any other EAP authentication methods, you must use EAP relay. When
you make your decision, see "Comparing EAP relay and EAP termination" for help.
For more information about EAP relay and EAP termination, see "802.1X authentication procedures."
To configure EAP relay or EAP termination:
Step Command Remarks
1. Enter system
view.
system-view
N/A
2. Configure EAP
relay or EAP
termination.
dot1x
authentication-method
{
chap
|
eap
|
pap
}
By default, the network access device performs
EAP termination and uses CHAP to communicate
with the RADIUS server.
Specify the
eap
keyword to enable EAP relay.
Specify the
chap
or
pap
keyword to enable
CHAP-enabled or PAP-enabled EAP termination.
NOTE:
If EAP relay mode is used, the user-name-format command configured in RADIUS scheme view
does not take effect. The access device sends the authentication data from the client to the server
without any modification.
Setting the port authorization state
The port authorization state determines whether the client is granted access to the network. You can
control the authorization state of a port by using the dot1x port-control command and the following
keywords:
• authorized-force—Places the port in the authorized state, enabling users on the port to access
the network without authentication.
• unauthorized-force—Places the port in the unauthorized state, denying any access requests
from users on the port.
• auto—Places the port initially in the unauthorized state to allow only EAPOL packets to pass,
and after a user passes authentication, sets the port in the authorized state to allow access to
the network. You can use this option in most scenarios.
You can set authorization state for one port in interface view, or for multiple ports in system view. If
different authorization state is set for a port in system view and interface view, the one set later takes
effect.
To set the authorization state of a port:
Step Command Remarks
1. Enter system
view.
system-view
N/A

HPE FlexNetwork MSR Series Specifications

General

Brand	HPE
Model	FlexNetwork MSR Series
Category	Network Router
Language	English