Table of Contents
Advertisement
User Authentication Overview
Implementing User Authentication
Take the following steps to implement user authentication:
•
Determine the types of devices to be authenticated.
•
Determine the correct authentication type for each device.
•
Determine an appropriate policy best suited for the use of that device on your network.
•
Configure RADIUS user accounts on the authentication server for each device.
•
Configure user authentication.
Authentication Methods
For information about...
IEEE 802.1x Using EAP
MAC-Based Authentication (MAC)
Port Web Authentication (PWA)
Multi-User And MultiAuth Authentication
Remote Authentication Dial-In Service (RADIUS)
IEEE 802.1x Using EAP
The IEEE 802.1x port-based access control standard allows you to authenticate and authorize user
access to the network at the port level. Access to the switch ports is centrally controlled from an
authentication server using RADIUS. The Extensible Authentication Protocol (EAP), defined in
RFC 3748, provides the means for communicating the authentication information.
There are three supported types of EAP:
•
MD5 – EAP-MD5 is a challenge-handshake protocol over EAP that authenticates the user
with a normal username and password.
•
TLS – EAP-TLS provides a transport layer security based upon the presentation and
acceptance of digital certificates between the supplicant and the authentication server.
•
Protected – Protected Extensible Authentication Protocol (PEAP) optionally authenticates the
authentication server to the client using an X-509 certificate using a TLS tunnel, after which
the client authentication credentials are exchanged.
All Enterasys platforms support IEEE 802.1x, which protects against unauthorized access to a
network, DoS attacks, theft of services and defacement of corporate web pages.
802.1x configuration consists of setting port, global 802.1x parameters, and RADIUS parameters
on the switches to point the switch to the authentication server. The Filter-ID RADIUS attribute
can be configured on the authentication server to direct dynamic policy assignment on the switch
to the 802.1x authenticating end system.
MAC-Based Authentication (MAC)
MAC-based authentication (MAC) authenticates a device using the source MAC address of
received packets. The authenticator sends the authentication server a source MAC address as the
user name and a password that you configure on the switch. If the authentication server receives
valid credentials from the switch, RADIUS returns an Accept message to the switch. MAC
authentication enables switches to authenticate end systems, such as printers and camcorder
10-2 Configuring User Authentication
Refer to page...
10-2
10-2
10-3
10-3
10-7
- Quick Links:
- Connecting to the Switch
Hide quick links:
Advertisement
Table of Contents
