SMC Networks ElliteConnect 2.4GHz/5GHz Owner's Manual page 95

Note: Client station MAC authentication occurs prior to the IEEE 802.1X
authentication procedure configured for the access point.
However, a client's MAC address provides relatively weak user
authentication, since MAC addresses can be easily captured and
used by another station to break into the network. Using 802.1X
provides more robust user authentication using user names and
passwords or digital certificates. So, although you can configure
the access point to use MAC address and 802.1X authentication
together, it is better to choose one or the other, as appropriate.
802.1X Setup – IEEE 802.1X is a standard framework for network
access control that uses a central RADIUS server for user
authentication. This control feature prevents unauthorized access
to the network by requiring an 802.1X client application to submit
user credentials for authentication. The 802.1X standard uses the
Extensible Authentication Protocol (EAP) to pass user credentials
(either digital certificates, user names and passwords, or other)
from the client to the RADIUS server. Client authentication is then
verified on the RADIUS server before the access point grants
client access to the network.
The 802.1X EAP packets are also used to pass dynamic unicast
session keys and static broadcast keys to wireless clients.
Session keys are unique to each client and are used to encrypt
and correlate traffic passing between a specific client and the
access point. You can also enable broadcast key rotation, so the
access point provides a dynamic broadcast key and changes it at
a specified interval.
You can enable 802.1X as optionally supported or as required to
enhance the security of the wireless network.
•
Disable: The access point does not support 802.1X
authentication for any wireless client. After successful
wireless association with the access point, each client is
allowed to access the network.
Advanced Configuration
6-19