H3C Technologies H3C S12500-X Series Switches - Manual (Page 89)

77
Task Command
Display 802.1X session information, statistics, or
configuration information of specified or all ports. display dot1x [ sessions | statistics ] [ interface
interface-type interface-number ]
Clear 802.1X statistics.
reset dot1x statistics [ interface interface-type
interface-number ]
51B
802.1X authentication configuration example
196B
Network requirements
As shown in
777H
Figure 31 , the access device performs 802.1X authentication for users that connect to port
Ten-GigabitEthernet 1/0/1. Implement MAC-based access control on the port, so the logoff of one user
does not affect other online 802.1X users.
Use RADIUS servers to perform authentication, authorization, and accounting for the 802.1X users. If
RADIUS authentication fails, perform local authentication on the access device.
Configure the host at 10.1.1.1/24 as the primary authentication and accounting servers, and the host at
10.1.1.2/24 as the secondary authentication and accounting servers. Assign all users to the ISP domain
aabbcc.net.
Configure the shared key as name for packets between the access device and the authentication server,
and the shared key as money for packets between the access device and the accounting server.
Figure 31 Network diagram
197B
Configuration procedure
1. Configure the 802.1X client. If H3C iNode is used, do not select the Carry version info option in
the client configuration. (Details not shown.)
2. Configure the RADIUS servers and add user accounts for the 802.1X users. (Details not shown.)
For information about the RADIUS commands used on the access device in this example, see
Security Command Reference.
3. Assign an IP address for each interface on the access device. (Details not shown.)
4. Configure user accounts for the 802.1X users on the access device:
Internet
Device
Authenticator
Host
192.168.1.2/24
XGE1/0/1
Vlan-int2
192.168.1.1/24
RADIUS server cluster
Primary: 10.1.1.1/24
Secondary: 10.1.1.2/24
Supplicant
XGE1/0/2
10.1.1.10/24