Users Guide

Table Of Contents

Authentication, Authorization, and Accounting 335

As shown in Figure 10-3, the Dell EMC Networking switch is the

authenticator and ensures that the supplicant (a PC) that is attached to an

802.1X-controlled port is authenticated by an authentication server (a

RADIUS server). The result of the authentication process determines

whether the supplicant is authorized to access network services on that

controlled port. Dell EMC Networking N-Series switches support 802.1X

authentication using remote RADIUS or using a local authentication service

(IAS).

Supported security methods for supplicant communication with remote

authentication servers include MD5, PEAP, EAP-TTL, EAP-TTLS, and EAP-

TLS. Only EAP-MD5 is supported when using the local authentication server

(IAS) for communication with the supplicant.

For a list of RADIUS attributes that the switch supports, see "Using RADIUS"

on page 288.

What are the 802.1X Port Authentication Modes?

The 802.1X port authentication mode determines whether to allow or prevent

network traffic on the port. A port can configured to be in one of the

following 802.1X authentication modes:

• Auto (default)

• MAC-based

• Force-authorized

• Force-unauthorized

These modes control the behavior of the port. The port state is either

Authorized or Unauthorized. 802.1X auto mode may be configured on ports

in general or access mode. 802.1X is not supported on trunk mode ports.

If the port is in the force-authorized mode, the port state is Authorized and

the port sends and receives normal traffic without client port-based

authentication. When a port is in a forced-unauthorized mode, the port state

is Unauthorized and the port ignores supplicant authentication attempts and

does not provide authentication services. By default, when 802.1X is globally

enabled on the switch, all ports are in auto authentication mode, which

means the port will be unauthorized until a successful authentication

exchange has taken place. Auto mode (port based mode) is suitable for

authentication of a single supplicant attached to a port. If multiple devices