X Port-Based And Host-Based Access Control - D-Link DGS-3700-12 User Manual

DGS-3700-12/DGS-3700-12G Series Layer 2 Gigabit Ethernet User Manual
802.1X

802.1X Port-Based and Host-Based Access Control

The IEEE 802.1X standard is a security measure for authorizing and authenticating users to gain access to various
wired or wireless devices on a specified Local Area Network by using a Client and Server based access control
model. This is accomplished by using a RADIUS server to authenticate users trying to access a network by relaying
Extensible Authentication Protocol over LAN (EAPOL) packets between the Client and the Server. The following figure
represents a basic EAPOL packet:
Figure 8- 1 The EAPOL Packet
Utilizing this method, unauthorized devices are restricted from connecting to a LAN through a port to which the user is
connected. EAPOL packets are the only traffic that can be transmitted through the specific port until authorization is
granted. The 802.1X Access Control method holds three roles, each of which are vital to creating and maintaining a
stable and working Access Control security method.
Figure 8- 2 The three roles of 802.1X
The following section will explain the three roles of Client, Authenticator and Authentication Server in greater detail.
Authentication Server
The Authentication Server is a remote device that is connected to the same network as the Client and Authenticator,
must be running a RADIUS Server program and must be configured properly on the Authenticator (Switch). Clients
connected to a port on the Switch must be authenticated by the Authentication Server (RADIUS) before attaining any
services offered by the Switch on the LAN. The role of the Authentication Server is to certify the identity of the Client
attempting to access the network by exchanging secure information between the RADIUS server and the Client
through EAPOL packets and, in turn, informs the Switch whether or not the Client is granted access to the LAN and/or
switches services.
196