X Port-Based Authentication - Alcatel OS-LS-6224 User Manual

CLI – The following is an example of the Port Security CLI commands:
Console(config)# interface ethernet 1/e1
Console(config-if)# port security forward trap 100
Console(config-if)# port security mode
Console(config-if)# port security max 20

802.1X Port-Based Authentication

Network switches can provide open and easy access to network resources by
simply attaching a client PC. Although this automatic configuration and access is a
desirable feature, it also allows unauthorized personnel to easily intrude and
possibly gain access to sensitive network data.
The IEEE 802.1x (dot1x) standard defines a port-based access control procedure
that prevents unauthorized access to a network by requiring users to first submit
credentials for authentication. Access to all switch ports in a network can be
centrally controlled from a server, which means that authorized users can use the
same credentials for authentication from any point within the network.
Port-based authentication authenticates users on a per-port basis via an external
server. Only authenticated and approved system users can transmit and receive
data. Ports are authenticated via the RADIUS server using the Extensible
Authentication Protocol (EAP). Port-based authentication includes:
• Authenticators — Specifies the device port which is authenticated before
permitting system access.
• Supplicants — Specifies the host connected to the authenticated port requesting
to access the system services.
• Authentication Server — Specifies the server that performs the authentication on
behalf of the authenticator, and indicates whether the supplicant is authorized to
access system services.
The RADIUS server verifies the client identity and sends an access challenge back
to the client. The EAP packet from the RADIUS server contains not only the
challenge, but the authentication method to be used. The client can reject the
authentication method and request another, depending on the configuration of the
client software and the RADIUS server.
The RADIUS server verifies the client credentials and responds with an accept or
reject packet. If authentication is successful, the switch allows the client to access
the network. Otherwise, network access is denied and the port remains blocked.
Port-based authentication creates two access states:
• Controlled Access — Permits communication between the supplicant and the
system, if the supplicant is authorized.
• Uncontrolled Access — Permits uncontrolled communication regardless of the
port state.
The device currently supports port-based authentication via RADIUS servers.
802.1X Port-Based Authentication
3
4-380
4-326
4-326
4-327
151