802.1x Configuration Examples H3C S7500 Series Ethernet Switches Release Table of Contents

Size: px

Start display at page:

Download "802.1x Configuration Examples H3C S7500 Series Ethernet Switches Release Table of Contents"

Baldwin Norton
5 years ago
Views:

1 Table of Contents Table of Contents Chapter X Overview Introduction to 802.1X Features Configuration Global Configuration Configuration in Port View Precautions Chapter X Configuration Commands Network Application Analysis Network Diagram Configuration Procedure Configuring the Switch Configuring the RADIUS Server Configuring the Supplicant System Verifying Configuration Troubleshooting i

2 Abstract 802.1x Configuration Example Keywords: 802.1x and AAA Abstract: This article introduces the application of 802.1x on Ethernet switches in real network environments, and then presents detailed configurations of the 802.1x client, LAN Switch and AAA server respectively. Acronyms: AAA (Authentication, Authorization and Accounting) ii

3 Chapter X Overview Chapter X Overview Note: The use of this document is restricted to H3C S7500 Series Ethernet switches. 1.1 Introduction to 802.1X The LAN defined in IEEE 802 protocols does not provide access authentication. In general, users can access network devices or resources in a LAN as long as they access the LAN. When it comes to application circumstances like telecom network access, building, LAN and mobile office, however, administrators need to control and configure the access of user devices. Therefore, port- or user-based access control comes into being x is a port-based network access control protocol. It is widely accepted by vendors, service providers and end users for its low cost, superior service continuity and scalability, and high security and flexibility. 1.2 Features Configuration Global Configuration Enable 802.1x globally Set time parameters Set the maximum number of authentication request attempts Enable the quiet timer Enable re-authentication upon reboot Configuration in Port View Enable dot1x on the port Enable Guest VLAN Set the maximum number of users supported on the port Set a port access control method (port-based or MAC-based) Set a port access control mode (force-authorized, force-unauthorized or auto) Enable client version checking Enable proxy detection 1-1

4 Chapter X Overview Precautions The configuration of dot1x on a specific port takes effect only after the dot1x feature is enabled globally and on the port. You can configure dot1x parameters associated with Ethernet ports or devices before enabling dot1x. However, the configured dot1x parameters only take effect after dot1x is enabled. The configured dot1x parameters are reserved after dot1x is disabled and will take effect if dot1x is re-enabled. 1-2

5 Chapter X Configuration Commands Chapter X Configuration Commands To implement 802.1x, you need to configure the supplicant system (client), authenticator system (switch) and authentication/authorization server correctly. Supplicant system: Ensures that the PC uses a right client. Authenticator system: Configuring 802.1x and AAA on the authenticator system is required. Authentication/authorization server: Configuring the authentication/authorization server correctly is required. The following table shows 802.1x configuration commands necessary for configuring the switch (authenticator system). For configuration information on other devices, refer to related manuals. Table x configuration commands To do Use the command Remarks Enter system view system-view Enable 802.1x globally Enable 802.1x for one or more ports Set a port access control method for the specified or all ports Enable Guest VLAN on the specified or all ports dot1x In system view dot1x [ interface interface-list ] In port view dot1x In system view: dot1x port-method { macbased portbased } [ interface interface-list ] In port view: dot1x port-method { macbased portbased } In system view: dot1x guest-vlan vlan-id [ interface interface-list ] In port view: dot1x guest-vlan vlan-id Required Disabled by default Required Disabled on a port by default 802.1x must be enabled both globally in system view and on the intended port in system view or port view. Otherwise, it does not function. Optional macbased by default Port-based access control is required for Guest VLAN. Optional Not enabled by default The vlan-id of the Guest VLAN must be created beforehand. 2-1

6 Note: The configuration or information displayed may vary with devices. The following takes the H3C S7500 series switch (using software Release 3135) as an example. 3.1 Network Application Analysis An administrator of an enterprise network needs to authenticate users accessing the network on a per-port basis on the switch to control access to network resources. Table 3-1 shows the details of network application analysis. Table 3-1 Network application analysis Network requirements Solution Access of users is controlled by authentication. Users can only access VLAN 10 before the authentication succeeds. Users can access VLAN 100 after the authentication succeeds. Users select the monthly payment service of 50 dollars and use 2M bandwidth to access the network. IP address and MAC address are bound after a user logs in. Tear down the connection by force if it is idle for 20 minutes. Users can be re-authenticated successfully after the switch reboots abnormally. Enable 802.1x Enable Guest VLAN Enable dynamic VLAN assignment Configure an accounting policy and bandwidth restraint policy on the RADIUS server Set MAC-to-IP binding Enable idle cut Enable re-authentication upon reboot 3-1

7 3.2 Network Diagram Figure 3-1 Network diagram for enterprise network application 3.3 Configuration Procedure Configuring the Switch # Create a RADIUS scheme named cams, and specify the primary and secondary authentication/accounting servers. <H3C> system-view [H3C] radius scheme cams [H3C-radius-cams] primary authentication [H3C-radius-cams] primary accounting [H3C-radius-cams] secondary authentication [H3C-radius-cams] secondary accounting # Set the password to expert for the switch to exchange messages with the RADIUS authentication and accounting servers. [H3C-radius-cams] key authentication expert [H3C-radius-cams] key accounting expert # Set the username format to fully qualified username with domain name. [H3C-radius-cams] user-name-format with-domain # Set the server type to extended. [H3C-radius-cams] server-type extended # Enable re-authentication upon reboot. [H3C-radius-cams] accounting-on enable 3-2

8 # Create an ISP domain named abc and adopt the RADIUS scheme cams for authentication. [H3C] domain abc [H3C-isp-abc] radius-scheme cams # Set the dynamic VLAN assignment mode. [H3C-isp-abc] vlan-assignment-mode integer [H3C-isp-abc] quit # Set the ISP domain abc as the default ISP domain. [H3C] domain default enable abc # Enable Guest VLAN 10 on the specified port. [H3C] vlan 10 [H3C-Ethernet3/0/3] dot1x port-method portbased [H3C-Ehternet3/0/3] dot1x guest-vlan 10 # Enable 802.1x globally. [H3C] dot1x # Enable dot1x for port Ethernet 3/0/3. [H3C] dot1x interface ethernet3/0/3 # Use the display command to view the configuration associated with 802.1x and AAA parameters. [H3C] display dot1x interface ethernet3/0/3 Equipment 802.1x protocol is enabled CHAP authentication is enabled DHCP-launch is disabled Proxy trap checker is disabled Proxy logoff checker is disabled Guest Vlan is enabled Configuration: Transmit Period 30 s, Handshake Period 15 s ReAuth Period s Quiet Period 60 s, Quiet Period Timer is disabled Supp Timeout 30 s, Server Timeout 100 s Interval between version requests is 30s maximal request times for version information is 3 The maximal retransmitting times 2 Total maximum 802.1x user resource number is 4096 Total current used 802.1x resource number is 0 Ethernet3/0/3 is link-up 3-3

9 802.1x protocol is enabled Proxy trap checker is disabled Proxy logoff checker is disabled Guest Vlan: 10 Version-Check is disabled The port is a(n) authenticator Authentication Mode is Auto Port Control Type is Port-based ReAuthenticate is disabled Max on-line user number is 1024 Authentication Success: 0, Failed: 0 EAPOL Packets: Tx 0, Rx 0 Sent EAP Request/Identity Packets : 0 EAP Request/Challenge Packets: 0 Received EAPOL Start Packets : 0 EAPOL LogOff Packets: 0 EAP Response/Identity Packets : 0 EAP Response/Challenge Packets: 0 Error Packets: 0 Controlled User(s) amount to 0 [H3C] display radius cams SchemeName =cams Index=1 Type=extended Primary Auth IP = Port=1812 Primary Acct IP = Port=1813 Second Auth IP = Port=1812 Second Acct IP = Port=1813 Auth Server Encryption Key= expert Acct Server Encryption Key= expert Accounting method = required Accounting-On packet enable, send times = 40, interval = 3s TimeOutValue(in second)=3 RetryTimes=3 RealtimeACCT(in minute)=12 Permitted send realtime PKT failed counts =5 Retry sending times of noresponse acct-stop-pkt =500 Quiet-interval(min) =5 Username format =with-domain Data flow unit =Byte Packet unit =1 [H3C] display domain abc The contents of Domain abc: State = Active 3-4

RADIUS Scheme = cams Access-limit = Disable Vlan-assignment-mode = Integer accounting-mode = time Domain User Template: Idle-cut = Disable Self-service = Disable Messenger Time = Disable 3.

10 RADIUS Scheme = cams Access-limit = Disable Vlan-assignment-mode = Integer accounting-mode = time Domain User Template: Idle-cut = Disable Self-service = Disable Messenger Time = Disable Configuring the RADIUS Server The configuration of CAMS authentication, authorization and accounting server consists of four parts: Creating an accounting policy Adding a service Adding an account user Configuring the access device The following parts take CAMS server V1.20 (standard version) as an example to introduce CAMS configuration. I. Logging in the CAMS configuration console 1) Enter the correct username and password on the login page to log in to the CAMS configuration console. Figure 3-2 Login page of CAMS configuration console 3-5

2) After login, the following page appears: Figure 3-3 CAMS configuration console II. Creating an accounting policy 1) Enter the Accounting Policy Management page.

On the navigation tree, select Charges Management > Accounting Policy to enter the Accounting Policy Management page, as shown in Figure 3-4.

11 2) After login, the following page appears: Figure 3-3 CAMS configuration console II. Creating an accounting policy 1) Enter the Accounting Policy Management page. Log in the CAMS configuration console. On the navigation tree, select Charges Management > Accounting Policy to enter the Accounting Policy Management page, as shown in Figure 3-4. Figure 3-4 Accounting Policy Management The list shows the created accounting policies. You can query, modify or copy these policies. 2) Create an accounting policy. Click Add to enter the Accounting Policy Basic Information page and create a monthly payment accounting policy, as shown in Figure

Figure 3-5 Accounting Policy Basic Information 3) Click Next to enter the Accounting Attribute Settings page, and set

Figure 3-6 Accounting Attribute Settings Click OK. A monthly payment accounting policy is created. III.

On the navigation tree, select Service Management > Service Config to enter the Service Config page, as shown in Figure 3-7.

12 Figure 3-5 Accounting Policy Basic Information 3) Click Next to enter the Accounting Attribute Settings page, and set Accounting Type to By duration, Monthly Cycle to Monthly and Monthly Fixed Fee to 50 dollars, as shown in Figure 3-6. Figure 3-6 Accounting Attribute Settings Click OK. A monthly payment accounting policy is created. III. Adding a service 1) Enter the Service Config page. Log in the CAMS configuration console. On the navigation tree, select Service Management > Service Config to enter the Service Config page, as shown in Figure 3-7. Figure 3-7 Service Config The list shows the created service types. You can query, modify or delete these service types. 2) Add a service. Click Add to enter the Add Service page and configure as follows: 3-7

Service Name: abc Service Suffix Name: abc Accounting Policy: Monthly Fixed Payment Upstream Rate Limitation: 2M (2048 Kbps) Downstream Rate Limitation: 2M (2048

Adding an account user 1) Enter the Account Management page. Log in the CAMS configuration console.

13 Service Name: abc Service Suffix Name: abc Accounting Policy: Monthly Fixed Payment Upstream Rate Limitation: 2M (2048 Kbps) Downstream Rate Limitation: 2M (2048 Kbps) VLAN Assignment: VLAN 100 Authentication Binding: Bind user IP address and bind user MAC address Figure 3-8 Add Service Click OK. A service type is added. IV. Adding an account user 1) Enter the Account Management page. Log in the CAMS configuration console. On the navigation tree, select User Management > Account User to enter the Account Management page, as shown in Figure 3-9. Figure 3-9 Account Management The list shows the created account users. You can maintain these account users. 3-8

14 2) Add an account user. Click Add to enter the Add Account page and configure as follows: Account: info Password: info Full Name: Bruce Prepaid Money: 100 dollars Bind multiple IP address and MAC address: enable Online Limit: 1 Max. Idle Time: 20 minutes Service Information: abc Figure 3-10 Add Account Click OK. An account user is added. V. Configuring the access device 1) Enter the System Configuration page. Log in the CAMS configuration console. On the navigation tree, select System Management > System Configuration to enter the System Configuration page, as shown in Figure

Figure 3-11 System Configuration 2) Click the Modify link for the Access

device configuration like IP address, shared key, and authentication and

Adding configuration item 1) Click Add to enter the Add Access Device page

15 Figure 3-11 System Configuration 2) Click the Modify link for the Access Device item to enter the Access Device Configuration page to modify access device configuration like IP address, shared key, and authentication and accounting ports. Figure 3-12 Access Device Configuration VI. Adding configuration item 1) Click Add to enter the Add Access Device page and add configuration items, as shown in Figure Figure 3-13 Add Access Device 3-10

2) Click OK. The prompt page appears as shown in Figure 3-14.

the configuration take effect immediately. Figure 3-15 Validate Now on System Management page 3.3.3 Configuring the Supplicant System You need to install an 802.

16 2) Click OK. The prompt page appears as shown in Figure Figure 3-14 Page prompting that system configuration is modified successfully 3) Return to the System Configuration page and click Validate Now to make the configuration take effect immediately. Figure 3-15 Validate Now on System Management page Configuring the Supplicant System You need to install an 802.1x client on the PC, which may be H3C s 802.1x client, the client shipped with Windows XP or other client from the third party. The following takes H3C s inode client as an example to introduce how to configure the supplicant system. 3-11

17 I. Starting up H3C inode intelligent client Figure 3-16 H3C inode intelligent client II. Creating a connection To create a connection, follow the steps below: 1) Click the New Connection link in the left pane of the client interface to launch the Create New Connection Wizard dialog box. 2) Click Next in the wizard dialog box, and then select 802.1x protocol as the authentication protocol. 3) Click Next and then select Common connection as the connection type. 4) Click Next to enter the Account Information page, as shown in Figure

18 Figure 3-17 Create an 802.1x connection 5) Enter a connection name, username and password, and check/uncheck the Save password checkbox as required. 6) Click Next to enter the Network Property Settings page, as shown in Figure 3-18, to configure the connection attributes. 3-13

19 Figure 3-18 Set special properties 7) Keep the default settings and click OK, and then click Create after confirming the settings. The connection is created and the connection icon is displayed on the client interface. III. Initiating the connection Double click the Info connection icon on the client interface, and then click Connect in the popup dialog box, as shown in Figure

Figure 3-19 Connection dialog box The connection is established after successful authentication. 3.3.4 Verifying Configuration To verify that the configuration of Guest VLAN is taking effect, check that users can access VLAN 10 before 802.

20 Figure 3-19 Connection dialog box The connection is established after successful authentication Verifying Configuration To verify that the configuration of Guest VLAN is taking effect, check that users can access VLAN 10 before 802.1x authentication or the 802.1x authentication fails. To verify that the dynamically assigned VLAN is taking effect, check that users can access VLAN 100 after 802.1x authentication succeeds. At the same time, 802.1x authentication cooperates with CAMS to complete accounting and real time monitoring. To verify that the configuration of IP-to-MAC binding is taking effect, check that users can be re-authenticated and access the Internet when the device reboots abnormally. If the configured IP-to-MAC binding is different from that on the CAMS, the user cannot access the Internet Troubleshooting I. Symptom: 802.1x authentication failed Solution: Use the display dot1x command to verify 802.1x is enabled globally and on the specified ports. Verify that the username and password are set correctly. Verify that the connection works well. 3-15

21 Use the debugging dot1x packet command to verify that the switch receives and sends EAP packets and EAPoL frames normally. II. Symptom: Users can access network resources without 802.1x authentication Use the display dot1x command to verify 802.1x is enabled globally and on the specified ports. Use the display interface command to verify the statistics of incoming packets are available for the specified port x authentication applies only to incoming packets, not outgoing packets. 3-16

Table of Contents. 4 System Guard Configuration 4-1 System Guard Overview 4-1 Guard Against IP Attacks 4-1 Guard Against TCN Attacks 4-1

Table of Contents. 4 System Guard Configuration 4-1 System Guard Overview 4-1 Guard Against IP Attacks 4-1 Guard Against TCN Attacks 4-1 Table of Contents 1 802.1x Configuration 1-1 Introduction to 802.1x 1-1 Architecture of 802.1x Authentication 1-1 The Mechanism of an 802.1x Authentication System 1-3 Encapsulation of EAPoL Messages 1-3