User Documentation

User Manual Managed Switches

3.1.10.2 Using Port Access Control

The Weidmüller Premium Line switches provide two kinds of Port-Based Access Control:

 Static Port Lock

 IEEE 802.1X

Static Port Lock

In this case the Weidmüller switch can be configured to protect static MAC addresses for a specific

port. With the Port Lock function, these locked ports will not learn any additional addresses, but only

allow traffic from preset static MAC addresses, helping to block hackers and careless usage.

Access control according IEEE 802.1X

The IEEE 802.1X standard defines a protocol for client/server-based access control and

authentication. The protocol restricts unauthorized clients from connecting to a LAN through ports

that are open to the Internet, and which otherwise would be readily accessible. The purpose of the

authentication server is to check each client that requests access to the port. The client is only

allowed access to the port if the client's permission is authenticated.

Three components are used to create an authentication mechanism based on 802.1X standards:

Client/Supplicant, Authentication Server, and Authenticator.

Client/Supplicant: The end station that requests access to the LAN and switch services and

responds to the requests from the switch.

Authentication server: The server that performs the actual authentication of the supplicant.

Authenticator: Edge switch or wireless access point that acts as a proxy between the supplicant

and the authentication server, requesting identity information from the supplicant, verifying the

information with the authentication server, and relaying a response to the supplicant.

The Weidmüller switch acts as an authenticator in the 802.1X environment. A supplicant and an

authenticator exchange EAPOL (Extensible Authentication Protocol over LAN) frames with each

other. We can either use an external RADIUS server as the authentication server, or implement the

authentication server in the Weidmüller switch by using a Local User Database as the authentication

look-up table. When we use an external RADIUS server as the authentication server, the

authenticator and the authentication server exchange EAP frames between each other.

Authentication can be initiated either by the supplicant or the authenticator. When the supplicant

initiates the authentication process, it sends an EAPOL-Start frame to the authenticator. When the

authenticator initiates the authentication process or when it receives an EAPOL Start frame, it sends

an EAP Request/Identity frame to ask for the username of the supplicant. The following actions are

described below: