User guide

Configuring Ethernet Ports
Working with 802.1X on Wired Ethernet Ports
ZoneFlex Outdoor Access Point 9.8.1 User Guide, 800-70598-001 Rev B 105
For wired 802.1X, a Ruckus AP’s Ethernet port can be configured as either an
Authenticator or as a Supplicant, depending on which port type is selected. Tab l e
32 and Tab l e 33 describe the 802.1X roles available by port type.
The following considerations apply:
• A single port cannot be configured as both an Authenticator and Supplicant at
the same time.
• Only one port per AP can be configured as a Supplicant.
• If the AP is connecting to a switch port with 802.1X authentication enabled, the
AP’s port type should be configured as a Trunk Port and its role should be
configured as Supplicant. The switch port should be configured as a Trunk port
in Port-based Authenticator mode.
• If there are multiple devices connected to an AP port (through a downstream
switch), the port can be configured as either Port-based or MAC-based Authen-
ticator. In Port-based mode, only one of the attached MAC hosts must be
authorized for all hosts to be granted access to the network. In MAC-based
mode, each MAC host is individually authenticated.
• If a Trunk Port is configured as a Supplicant, a user name and password must
be entered to authenticate the port to the 802.1X-aware LAN switch.
• If an Access Port is configured as an Authenticator, the administrator must define
the RADIUS server that the Authenticator communicates with. All Ethernet ports
of a single AP are configured with the same RADIUS server.
Enable MAC authentication bypass: If MAC authentication bypass is enabled, the
port first attempts to authenticate the attached device by MAC address, and if that
fails, it tries to authenticate the device using 802.1X.
Table 32. Authenticator support by port type
Trunk Port Access Port General Port
Port-based mode X X X
MAC-based mode X
Table 33. Supplicant support by port type
Trunk Port Access Port General Port
Supplicant X