HP 6120XG HP ProCurve Series 6120 Blade Switches Access Security Guide - Page 262
Example of Configuring the VSA for RADIUS-assigned ACLs in a FreeRADIUS Server
View all HP 6120XG manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 262 highlights
Configuring RADIUS Server Support for Switch Services Configuring and Using RADIUS-Assigned Access Control Lists VENDOR BEGIN-VENDOR ATTRIBUTE END-VENDOR HP 11 HP ProCurve (HP) Vendor-Specific ID HP-IP-FILTER-RAW 61 STRING HP ProCurve (HP) Vendor-Specific Attribute for RADIUS-assigned ACLs Note that if you were also using the RADIUS server to administer 802.1p (CoS) priority, you would also insert the ATTRIBUTE entries for these functions above the END VENDOR entry. Figure 6-4. Example of Configuring the VSA for RADIUS-assigned ACLs in a FreeRADIUS Server 2. Enter the switch IP address, NAS (Network Attached Server) type, and the key in the FreeRADIUS clients.conf file. For example, if the switch IP address is 10.10.10.125 and the key is "1234", you would enter the follow ing in the server's clients.conf file: client 10.10.18.12 nastype = other secret = 1234 Note: The key configured in the switch and the secret configured in the RADIUS server supporting the switch must be identical. Refer to the chapter titled "RADIUS Authentication and Accounting" in the Access Security Guide for your switch. Figure 6-5. Example of Configuring the Switch's Identity Information in a FreeRADIUS Server 3. For a given client username/password pair or MAC address, create an ACL by entering one or more ACEs in the FreeRADIUS "users" file. Enter the ACEs in an order that promotes optimum traffic management and conser vation of system resources, and remember that every ACL you create automatically includes an implicit deny in ip from any to any ACE. For example, suppose that you wanted to create identical ACL support for the following: • a client having a username of "mobile011" and a password of "run101112" • a client having a MAC address of 08 E9 9C 4F 00 19 The ACL in this example must achieve the following: • permit http (TCP port 80) traffic from the client to the device at 10.10.10.101 • deny http (TCP port 80) traffic from the client to all other devices • permit all other traffic from the client to all other devices To configure the above ACL, you would enter the username/password and ACE information shown in figure6-6 into the FreeRADIUS users file. 6-22