H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 244)

230
Table 12 Port security configuration for WLAN ports
Port security mode Description
presharedKey, userLoginSecureExt,
userLoginSecureExtOrPresharedKey, and
macAddressAndPresharedKey
On WPA or RSN networks using any of these modes, key
negotiation must be enabled.
• In presharedKeyand macAddressAndPresharedKey modes,
you need to configure the PSK.
• In userLoginSecureExt mode, you do not need to configure the
PSK.
• In userLoginSecureExtOrPresharedKey mode, you can
determine whether to configure any PSK.
Port security modes other than
presharedKey,
userLoginSecureExtOrPresharedKey, and
macAddressAndPresharedKey
No key negotiation is performed and you do not need to enable
key negotiation.
NOTE:
•
When port security is not enabled, if the WLAN service template is of the crypto type, users cannot get
online directly; if the WLAN service template is of the clear type, users can get online directly. For more
information about the types of the WLAN service templates, see WLAN Configuration Guide.
• By default, 802.1X periodically sends multicast trigger frames to clients. To save the bandwidth on
WLAN ports, H3C recommends you disable the multicast trigger function. For more information about
configurations, see "Configuring 802.1X."
Setting the port security mode of a WLAN port
To set the port security mode of a WLAN port:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enter interface view.
interface interface-type
interface-number
N/A
3. Set a port security mode for the
WLAN port.
port-security port-mode { mac-and-psk
| mac-authentication |
mac-else-userlogin-secure |
mac-else-userlogin-secure-ext | psk |
userlogin-secure | userlogin-secure-ext
| userlogin-secure-ext-or-psk |
userlogin-secure-or-mac |
userlogin-secure-or-mac-ext |
userlogin-withoui }
By default, a port operates in
noRestrictions mode.
Enabling key negotiation
After a user passes 802.1X authentication, a WLAN port uses EAPOL-Key frames to negotiate the
link-layer session key with the user if the key negotiation function is enabled.
• If key negotiation is enabled, an authenticated user is allowed to access to the port only after the
key negotiation succeeds.