Configuring Port Authentication 802.1X - D-Link DGS-3100 SERIES User Manual

DGS-3100 Series Gigabit Stackable Managed Switch User Manual

Configuring Port Authentication 802.1X

Port-based authentication authenticates users on a per-port/per mac basis via an external server. Only authenticated and
approved system users can transmit and receive data. Ports are authenticated via the RADIUS server using the Extensible
Authentication Protocol (EAP). The 802.1x Access Control protocol consists of the following vital components which
stabilize Access Control Security:
Component
Authenticators
Supplicants/Clients
Authentication Server
Dynamic VLAN
Assignment (DVA)
Port-based authentication creates two access states:
State
Controlled Access
Uncontrolled Access
145
Description
The Authenticator is an intermediary between the Authentication Server and the Client. The
authenticator:
Requests certification information via the Client (EAPOL packets). The EAPOL packets
are the only information allowed to pass between supplicants and the authentication server
until the authenticator is granted system access.
Verifies the information gathered from the Client with the Authentication Server, and
relays the information to the Client.
Specifies the host connected to the authenticated port requesting to access the system services.
Specifies the server that performs the authentication on behalf of the authenticator, and
indicates whether the supplicant is authorized to access system services. The Authentication
Server is a remote device connected to the Client network and Authenticator. The
Authentication Server must have RADIUS Server application enabled and configured. Clients
connected to a port on the Switch must be authenticated by the Authentication Server before
accessing any system services. The Authentication Server certifies the client's identity
attempting to access the network by exchanging secure information between the RADIUS
server and the Client.
Assigns users to VLANs during the RADIUS server authentication. When a user is
authenticated by the RADIUS server, the user is automatically joined to the VLAN configured
on the RADIUS server. The VLANs that cannot participate in the DVA are:
– A Dynamic GVRP-created VLAN
– A Voice VLAN
– A Default VLAN
–
A Guest VLAN
Description
Permits communication between the supplicant and the system, if the supplicant is authorized.
Permits uncontrolled communication regardless of the port state.