Other Precautions For Configuring 802.1X - D-Link xStack DGS-3610 Series Configuration Manual

DGS-3610 Series Configuration Guide
Hello Interval: 20 Seconds
Hello Alive: 250 Seconds
DGS-3610#
37.3.6 Other Precautions for Configuring
802.1X
1. When there is no IP authorization mode, each device supports 10,000 authenticated
users.
2. Concurrent use of 1X and ACL
In the non-IP authorization mode, if you enable the 802.1X authentication function of a
port and at the same time associate one ACL with an interface, the ACL takes effect on
the basis of the MAC address. In other words, only the packets from the source MAC
addresses of the users that have passed the authentication can pass ACL filtering, and
the packets from other source MAC addresses will be discarded. The ACL can only
work on the basis of the MAC address.
For example, if the MAC address that has passed the authentication is 00d0.f800.0001,
then all the packets from the source MAC address of 00d0.f800.0001 can be switched.
If the port is associated with an ACL, the ACL will further filter these packets that can be
switched, for example, rejecting the ICMP packets from the source MAC address.
In the IP authorization mode, you are recommended not to set the ACL on the controlled
interface, since the ACL has a higher priority than the authentication user, and so the
IP+MAC binding that has passed the authentication will not take effect. On a port, the
following users are authenticated:
User 1: mac: 00d0.f800.0001 ip: 192.168.65.100
User 2: mac: 00d0.f800.0002 ip: 192.168.65.101
Then, set one ACL on the interface as follows:
ip access-list extended ip_acl:
deny icmp any any
The original purpose is to allow the communication of authenticated users and forbid
sending ICMP packets. However, the ACL has a higher priority than the IP + MAC that
has passed the authentication and the last default ACE of the ACL is deny any any, so
the authenticated users cannot communicate.
If the ip_acl is added with permit any any behind it, any authenticated users can still
communicate after changing its IP address, so the IP + MAC one-to-one binding is not
achieved. Therefore, IP authentication + ACL is not recommended.
3. The hardware entries for user authentication and the other applications (for example,
ACL, port IP security address) share the filtering entries and filtering domain templates
in the IP authentication mode. If other applications exhaust the hardware resources, the
user authentication may fail in the IP authorization mode, or though successful, the
Chapter 37 Configuration of 802.1X
37-35