Network Access Server Configuration - Planet Networking & Communication SGS-5220 User Manual

The page includes the following fields:
Object
• Client
• Authentication Method
Buttons
: Click to apply changes
: Click to undo any changes made locally and revert to previously saved values.

4.11.3 Network Access Server Configuration

This page allows you to configure the IEEE 802.1X and MAC-based authentication system and port settings.
The IEEE 802.1X standard defines a port-based access control procedure that prevents unauthorized access to a network by
requiring users to first submit credentials for authentication. One or more central servers, the backend servers, determine
whether the user is allowed access to the network. These backend (RADIUS) servers are configured on the
"Configuration→Security→AAA" page. The IEEE802.1X standard defines port-based operation, but non-standard variants
overcome security limitations as shall be explored below.
MAC-based authentication allows for authentication of more than one user on the same port, and doesn't require the user to
have special 802.1X supplicant software installed on his system. The switch uses the user's MAC address to authenticate
against the backend server. Intruders can create counterfeit MAC addresses, which makes MAC-based authentication less
secure than 802.1X authentication. The NAS configuration consists of two sections, a system- and a port-wide. The Network
Access Server Configuration screen in
Description
The management client for which the configuration below applies.
Authentication Method can be set to one of the following values:
■
None: authentication is disabled and login is not possible.
■
Local: use the local user database on the switch stack for authentication.
■
RADIUS: use a remote RADIUS server for authentication.
■
TACACS+: use a remote TACACS+ server for authentication.
Methods that involves remote servers are timed out if the remote servers are
offline. In this case the next method is tried. Each method is tried from left to right
and continues until a method either approves or rejects a user. If a remote server
is used for primary authentication it is recommended to configure secondary
authentication as 'local'. This will enable the management client to login via the
local user database if none of the configured authentication servers are alive.
Figure 4-11-4 appears.
232
User's Manual of SGS-5220 Series