ProCurve 2650 and 802.1x authentication - question

[Ed Wallig_1]

Hi,

Implementing 802.1x authentication for my wired (not wireless) company network and need some information before I jump headlong into this:

Building with 3 wiring closets. Each closet has a single HP ProCurve 2650 switch. Switches 1 and 3 are uplinked to switch 2 (servers located in this wiring closet) over Cat5e via GB port on each switch.

What I hope to achieve is a network where only authorized computers can access anything beyond the switch port that they are connected to. To do this, I want to use 802.1x with certificates (already have PKI in place) and port security (MAC address learning).

I appear to need the port security because in my initial tests, everything works fine until you add a downlevel desktop switch - anything connected to that switch has unfettered access through a Dot1x-controlled port after the 1st Dot1x-compliant device authenticates. Using MAC address learning should negate this issue.

I also want to ensure that only authorized network equipment (switches, etc) can connect to switch 2. Based on information from the 2650 admin guide, I understand that 2650 ports can be supplicants to another 2650 port. I would like to configure the uplink ports on switches 1 and 3 to be supplicants to the uplink port on switch 2.

My questions:

1. Given the switch configuration that I've given, are there any issues that I might run into?

2. Each switch handles 30 - 40 computers / printers. In this configuration, would I be able to use a static MAC assignment for each of the uplink ports that are acting as supplicants or will that cause problems?

I have all of the documentation that the HP site offers, but if anyone has any additional documentation (config guides, "notes from the field", etc) on this topic, please email it to me at ewallig@aerocontractors.com.


Thanks in advance.

[Sietze Reitsma]

Hello,

Turn portsecurity on, in this case only the authorised 802.1x client gets access.


#> port-security 1-24 learn-mode port-access

S