Comware

My current switches are the 1800-24G - I have a total of 4. They've treated me well, but I've been wanting to setup 802.1x which means I need something a bit beefier. I've been looking into the 2810-24G, which looks like a good switch for the price and includes 802.1x capability.

What I'm wondering is, how exactly would this work? I'd use the 2810 as the primary switch, with the 1800's connected to it. All I can find on the 1800 is this:

"Increased security by passing 802.1X information to upstream switches to authenticate users "
http://www.procurve.com/news/fanless1800.htm

I don't see anything in the 1800 config that addresses this at all. Can anyone offer any insight? If an unauthorized machine plugs into an 1800, does the 2810 block access for that entire switch?

802.1x is port base security protocol

should be on the edge switch port for better security performance

it's possible as you say
each port can authenticated 32 user your 1800 switch have 24 port and connect one port 2810 switch
but this operation inconvenient because first client authenticates and opens the port, and then another client authenticates, the port responds as if the original client has initiated a reauthentication.

I'm don't advice 802.1x must use on edge switch port.

Hi Bryan,

I assume it will work like this: the 1800 will forward EAPOL traffic to the 2810 and he will act as authenticator.
If you configure a client limit on the 2800, the switch will do user based network control rather than port based authentication. That means that the switch will distinguish between the MAC addresses on this port. Thus you can connect several PC on the 1800 and each PC has to perform its own authentication.
But this solution is not secure, because an authenticated MAC address can be easily spoofed and 802.1x authentication can be bypassed.
I recommend to use an access switch with 802.1x support. As far as I know the cheapest box would be a 2510 with 802.1x support.

Cheers,

Michael

so first the 18xx switches don't support 802.1x. Functionality has some price ;-). Depends what you want to accomplish. 2810-24G supports up to 2 802.1x sessions per port prevents user "piggybacking" on another user's IEEE 802.1X authentication. De 2910 supports up to 8 802.1x sessions and 3500/5400 up to 32 802.1x sessions.

The 3500/5400 can provide a dynamic acl per 802.1x session. So in your case all users will stay in the same vlan, but can have a different acl per sessions.

Ofcourse as mentioned before, a higher feature switch in the access like 2910al or 3500/5400 is preferable.

Okay, so sounds like this won't really work out the way I had hoped. I'll probably just pick up an extra 1810-24G, and any unauthorized users will just get bashed over the head ;)

Thanks for the assistance.