HP StorageWorks 8/80 Brocade Converged Enhanced Ethernet Administrator's Guide - Page 139

Configuring 802.1x Port Authentication, In this x protocol overview

Get HP StorageWorks 8/80 - SAN Switch PDF manuals and user guides View all HP StorageWorks 8/80 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 139 highlights

Chapter Configuring 802.1x Port Authentication 10 In this chapter •802.1x protocol overview 119 •802.1x configuration guidelines and restrictions 119 •802.1x authentication configuration tasks 120 •Interface-specific administrative tasks for 802.1x 120 802.1x protocol overview The 802.1x protocol defines a port-based authentication algorithm involving network data communication between client-based supplicant software, an authentication database on a server, and the authenticator device. In this situation the authenticator device is the Brocade FCoE hardware. As the authenticator, the Brocade FCoE hardware prevents unauthorized network access. Upon detection of the new supplicant, the Brocade FCoE hardware enables the port and marks it "unauthorized". In this state, only 802.1x traffic is allowed. All other traffic, such as DHCP and HTTP, is blocked. The Brocade FCoE hardware transmits an EAP-request to the supplicant, which responds with the EAP-response packet. The Brocade FCoE hardware, which then forwards the EAP-response packet to the RADIUS authentication server. If the credentials are validated by the RADIUS server database, the supplicant may access the protected network resources. NOTE 802.1x port authentication is not supported by LAG (Link Aggregation Group) or interfaces that participate in a LAG. NOTE The EAP-MD5, EAP-TLS, EAP-TTLS and PEAP-v0 protocols are supported by the RADIUS server and are transparent to the authenticator switch. When the supplicant logs off, it sends an EAP-logoff message to the Brocade FCoE hardware which then sets the port back to the "unauthorized" state. 802.1x configuration guidelines and restrictions Follow these 802.1x configuration guidelines and restrictions when configuring 802.1x: • If you globally disable 802.1x, then all interface ports with 802.1x authentication enabled automatically switch to force-authorized port-control mode. Converged Enhanced Ethernet Administrator's Guide 119 53-1001346-01

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
Converged Enhanced Ethernet Administrator’s Guide
119
53-1001346-01
Chapter
10
Configuring 802.1x Port Authentication
In this chapter
•
802.1x protocol overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
•
802.1x configuration guidelines and restrictions . . . . . . . . . . . . . . . . . . . . 119
•
802.1x authentication configuration tasks . . . . . . . . . . . . . . . . . . . . . . . . . 120
•
Interface-specific administrative tasks for 802.1x . . . . . . . . . . . . . . . . . . . 120
802.1x protocol overview
The 802.1x protocol defines a port-based authentication algorithm involving network data
communication between client-based supplicant software, an authentication database on a server,
and the authenticator device. In this situation the authenticator device is the Brocade FCoE
hardware.
As the authenticator, the Brocade FCoE hardware prevents unauthorized network access. Upon
detection of the new supplicant, the Brocade FCoE hardware enables the port and marks it
“unauthorized”. In this state, only 802.1x traffic is allowed. All other traffic, such as DHCP and
HTTP, is blocked. The Brocade FCoE hardware transmits an EAP-request to the supplicant, which
responds with the EAP-response packet. The Brocade FCoE hardware, which then forwards the
EAP-response packet to the RADIUS authentication server. If the credentials are validated by the
RADIUS server database, the supplicant may access the protected network resources.
NOTE
802.1x port authentication is not supported by LAG (Link Aggregation Group) or interfaces that
participate in a LAG.
NOTE
The EAP-MD5, EAP-TLS, EAP-TTLS and PEAP-v0 protocols are supported by the RADIUS server and
are transparent to the authenticator switch.
When the supplicant logs off, it sends an EAP-logoff message to the Brocade FCoE hardware which
then sets the port back to the “unauthorized” state.
802.1x configuration guidelines and restrictions
Follow these 802.1x configuration guidelines and restrictions when configuring 802.1x:
•
If you globally disable 802.1x, then all interface ports with 802.1x authentication enabled
automatically switch to force-authorized port-control mode.