Installation manual

3-88
SIGNAMAX LLC • www.signamax.eu
Configuring 802.1X Port Authentication
Network switches can provide open and easy access to network resources by simply
attaching a client PC. Although this automatic configuration and access is a desirable
feature, it also allows unauthorized personnel to easily intrude and possibly gain access
to sensitive network data.
The IEEE 802.1X (dot1X) standard defines a port-based access control procedure that
prevents unauthorized access to a network by requiring users to first submit credentials
for authentication. Access to all switch ports in a network can be centrally controlled from
a server, which means that authorized users can use the same credentials for
authentication from any point within the network.
This switch uses the Extensible
Authentication Protocol over LANs
(EAPOL) to exchange
authentication protocol messages
with the client, and a remote
RADIUS authentication server to
verify user identity and access
rights. When a client (i.e.,
Supplicant) connects to a switch
port, the switch (i.e., Authenticator)
responds with an EAPOL identity
request. The client provides its identity (such as a user name) in an EAPOL response to
the switch, which it forwards to the RADIUS server. The RADIUS server verifies the client
identity and sends an access challenge back to the client. The EAP packet from the
RADIUS server contains not only the challenge, but the authentication method to be
used. The client can reject the authentication method and request another, depending on
the configuration of the client software and the RADIUS server. The encryption method
used to pass authentication messages can be MD5 (Message-Digest 5), TLS (Transport
Layer Security), PEAP (Protected Extensible Authentication Protocol), or TTLS (Tunneled
Transport Layer Security). The client responds to the appropriate method with its
credentials, such as a password or certificate. The RADIUS server verifies the client
credentials and responds with an accept or reject packet. If authentication is successful,
the switch allows the client to access the network. Otherwise, non-EAP traffic on the port
is blocked or assigned to a guest VLAN based on the “intrusion-action” setting. In
“multi-host” mode, only one host connected to a port needs to pass authentication for all
other hosts to be granted network access. Similarly, a port can become unauthorized for
all hosts if one attached host fails re-authentication or sends an EAPOL logoff message.
The operation of 802.1X on the switch requires the following:
• The switch must have an IP address assigned.
• RADIUS authentication must be enabled on the switch and the IP address of the
RADIUS server specified.
• 802.1X must be enabled globally for the switch.
• Each switch port that will be used must be set to dot1X “Auto” mode.
802.1x
client
RADIUS
server
1. Client attempts to access a switch port.
2. Switch sends client an identity request.
3. Client sends back identity information.
4. Switch forwards this to authentication server.
5. Authentication server challenges client.
6. Client responds with proper credentials.
7. Authentication server approves access.
8. Switch grants client access to this port.