802.1X Modes; Configuring 802.1X Protocol - Avaya G250 Administration Manual

How port based authentication works
The authentication procedure is port-based, which means:
Access control is achieved by enforcing authentication on connected ports.
●
If an endpoint station that connects to a port is not authorized, the port state is set to
●
"unauthorized", which closes the port to all traffic.
As a result of an authentication attempt, the port can be either in a "blocked" or a
●
"forwarding" state. Since the spanning-tree application also controls the same forwarding
state of the port, the actual forwarding state of the port is the combination of the decisions
made by the two applications; e.g., if 802.1x or STA put the port into a "blocked" state, the
port is in a "blocked" state.
How MAC-based authentication works
In this mode, the port is always in a forwarding state, assuming STA doesn't block the port.
However, the G350 monitors the ingress/egress packets and only those originating from or
routed to the authenticated device are forwarded. If the device is not authenticated, the gateway
initiates authentication with the device. All unauthenticated device packets are discarded.
During this time, all authenticated supplicants can send and receive packets from the port.
The G250 behaves a little differently. The G250 controls only the egress packets, i.e., until the
device authenticates the port, all packets from the network to the device are blocked.

802.1x modes

- force-unauthorize. The port is always blocked
- auto. Whether the port is blocked or open depends on the authentication outcome
- force-authorize. The port is always open (in forwarding state)
By default, all ports are in auto mode. In other words, all ports are configured to use 802.1x
authentication if it is enabled on the G250/G350.

Configuring 802.1x Protocol

On the G350, you can configure 802.1x on the MM314 and MM316 10M/100M ports. Neither
the LAN and WAN port on the chassis nor the uplink port in the MM314 (10/100/1G copper) and
MM316 (10/100/1G copper) media modules support 802.1x.
On the G250, you can enable 802.1x on the eight Ethernet LAN PoE ports located on the
G250's front panel. 802.1x is not supported on the G250-DCP model.
1. Configure RADIUS authentication on the G250/G350.
Managing login permissions
Issue 5 June 2008 67