Configuration Examples‎ > ‎HP / HPE‎ > ‎Aruba HPE‎ > ‎

802.1x Port Authentication

How to configure 802.1x Port Authentication on HP Procurve Switches, and MAC Authentication for HP printers.

It also allows Avaya handsets to bypass authentication requests.

This guide shows you how to configure the network switch, and Microsoft NPS server configuration for the automatic 802.1x authentication of PC's and MAC authentication for other devices

It assumes you already have the Microsoft NPS server installed, and it also assumes you have a PKI already installed, and therefore a client certificate on those machines you want to enable 802.1x.... :)


First, plan out what VLAN you want to assign as your 'Authenticated' VLAN, and what VLAN you want to use as your 'Unauthorised VLAN'. Make sure you have DHCP running in both VLAN's, and first plug your laptop into an untagged port in both VLAN's to make sure that you can get an IP address / access the internet or other resources you expect 

This example uses the following:
User Authenticated VLAN =        10
Printer Authenticated VLAN =     5
Unauthorised VLAN =                 20
Voice VLAN =                             15
RADIUS Server =                        10.10.10.10

Client PC Configuration

Unlike the wireless network card, the wired authentication service is disabled by default, so you must enable it on every PC. Make sure this is in your group policy if you want to enable it on all machines in your domain.

For an individual PC, click start / run and type services.msc

Change the Startup Type to Automatic, and then start the service 
Wired 802.1x Service


Switch Configuration

First, configure the remote RADIUS server address, and make sure the 'reallysecretkey' matches what is configured on the RADIUS server.

radius-server host 10.10.10.10 encrypted-key reallysecretkey

Then configure EAP-RADIUS - this enables forwarding of authentication packets on the network ports.

aaa authentication port-access eap-radius

Switch Configuration - 802.1x

The following commands enables 802.1.x authentication on a range of ports, (1.44) you can speficy individual ports, or separate them with a comma (,)

aaa port-access authenticator 1-44
aaa port-access authenticator 1-44 unauth-vid 20
aaa port-access authenticator 1-44 auth-vid 5
aaa port-access authenticator active

Switch Configuration - MAC Authentication

I identified my printer ports in advance, and enabled MAC authentication specifically on those ports, note that the auth vlan is different to the user VLAN above.

aaa port-access mac-based 45,46
aaa port-access mac-based 45,46 unauth-vid 20
aaa port-access mac-based 45,46 auth-vid 10

Switch Configuration - Telephone Bypass

I sort of cheated here - LLDP-MED will assign a phone into a VLAN, bypassing it from the authentication process. Make sure that all ports are tagged in VLAN 15, and that the string 'voice' appears in the VLAN configuration

VLAN 15
 name 'Voice'
 tagged 1-46
 voice
 exit

RADIUS / Microsoft NPS Server Configuration

I assume you've already installed NPS, there's plenty of guides out there (just add it using the turn windows features on and off)

Make sure its registered in active directory:

Your RADIUS clients are where the RADIUS requests will be 'proxied' from, which is the network switch. Add each switch IP address, and the 'reallysecretkey' I mentioned earlier.

If you want to be a bit cleverer... and enable both MAC authentication and 802.1x authentication on your procurve switch ports, then I use the following:

aaa port-access authenticator 1-44
aaa port-access authenticator 1-44 auth-vid 10
aaa port-access authenticator 1-44 quiet-period 30
aaa port-access authenticator 1-44 tx-period 2
aaa port-access authenticator 1-44 supplicant-timeout 2
aaa port-access authenticator 1-44 server-timeout 10
aaa port-access authenticator 1-44 max-requests 3
aaa port-access authenticator 1-44 client-limit 2

aaa port-access mac-based 1-44
aaa port-access mac-based 1-44 addr-limit 2
aaa port-access mac-based 1-44 logoff-period 86400
aaa port-access mac-based 1-44 quiet-period 30
aaa port-access mac-based 1-44 server-timeout 10
aaa port-access mac-based 1-44 auth-vid 10
aaa port-access mac-based 1-44 unauth-vid 20
aaa port-access 1-44 controlled-direction in

And you enable it using:

aaa port-access authenticator active

There's quite a few lines of configuration in there, the main thing to note is that you HAVE TO ONLY configure the 'unauth-vid' on the MAC based authentication, otherwise you will encounter an error. Check the 'resources' links below for the reasoning behind why I chose those settings.

Resources