Product manual
primary authentication method to get a list
of all available backup methods.
Next Available Option:
■ primary < chap-radius | peap-mschapv2 > -- Specify the primary authentication method for
access control.(p. 43)
■ aaa port-access web-based
Usage: [no] aaa port-access web-based
[dhcp-addr <base address / mask> | dhcp-lease <5-25>]
[no] aaa port-access web-based [ethernet] PORT-LIST
[client-limit <1-32> | client-moves | ssl-login |
redirect-url <URL> | quiet-period <1-65535> |
server-timeout <1-300> | max-requests <1-10> |
max-retries <1-10> | logoff-period <1-9999999> |
reauth-period <0-9999999> | auth-vid VLAN-ID |
unauth-vid VLAN-ID | reauthenticate]
Description: Congure web authentication based network authentication
on the device or the device's port(s).
The rst form of the command sets the dhcp address
or lease parameter which are common to all ports
The second form of the command enables, disables, or
congures authentication on the device's individual ports.
o 'dhcp-addr' sets the base address / mask for the temporary
pool used by DHCP (base address default is 192.168.0.0,
mask default is 24 - 255.255.255.0)
o 'dhcp-lease' sets the lease length of the temporary
IP address issued by DHCP (default 10)
o 'client-limit' sets the maximum number of clients to allow on
the port. This includes ALL clients (authenticated and
unauthenticated). The default is 1 client.
NOTE: No more than 32 unique client MAC addresses can be
authorized by both 802.1X and MAC/web-based
authentication together on the same port.
o 'client-moves' sets whether the client can move
between ports that also have 'client-moves' enabled
(default disabled - no moves allowed).
o 'ssl-login' sets whether to enable SSL logins (https on
port 443). If enabled, logins to plaintext http (port 80)
are redirected to https port. The default is disabled.
o 'redirect-url' sets the URL that the user should be
redirected to after successful login (default none)
Specify url up to 103 characters length.
o 'quiet-period' sets the period of time during which the
switch does not try to authenticate after a failed
authentication attempt (default 60 seconds).
55© 2008 Hewlett-Packard Development Company, L.P.
aaaCommand Line Interface Reference Guide