Eap - Avaya 8800 Planning And Engineering, Network Design

• Security at Layer 3: announce and accept policies
• Routing protocol security

EAP

To protect the network from inside threats, the switch supports the 802.1x standard. EAP separates
user authentication from device authentication. If EAP is enabled, end-users must securely logon to
the network before obtaining access to any resource.
Interaction between 802.1x and Optivity Policy Server v4.0
User-based networking links EAP authorization to individual user-based security policies based on
individual policies. As a result, network managers can define corporate policies and configure them
on a per-port basis. This adds additional security based on a logon and password.
The Avaya Optivity Policy Server supports 802.1x EAP authentication against RADIUS and other
authentication, authorization, and accounting (AAA) repositories. This support helps authenticate the
user, grants access to specific applications, and provides real time policy provisioning capabilities to
mitigate the penetration of unsecured devices.
The following figure shows the interaction between 802.1x and Optivity Policy Server. First, the user
initiates a logon from a user access point and receives a request/identify request from the switch
(EAP access point). The user is presented with a network logon. Prior to DHCP, the user does not
have network access because the EAP access point port is in EAP blocking mode. The user
provides User/Password credentials to the EAP access point via Extensible Authentication Protocol
Over LAN (EAPoL). The client PC is considered both a RADIUS peer user and an EAP supplicant.
Figure 139: 802.1x and OPS interaction
Software support is included for the Preside (Funk) and Microsoft IAS RADIUS servers. Additional
RADIUS servers that support the EAP standard should also be compatible with the Avaya Ethernet
Routing Switch 8800/8600. For more information, contact your Avaya representative.
June 2016
on page 278
Planning and Engineering — Network Design
Comments on this document? infodev@avaya.com
on page 278
Data plane security
273