Ruckus Wireless ZoneDirector 1100 User Manual page 177

AP Ethernet port as authenticator
The Access Point is fundamentally a wireless switch. On APs with two or more wired ports, the
AP acts as a network edge switch and can be configured to authenticate downstream wired
stations (which can even be another edge switch). When the AP Ethernet port is configured as
an 802.1X authenticator, it can be further defined as either Port-based or MAC-based. MAC-
based authenticator mode is only supported if the port is an Access Port.
Figure 103. Authenticator support vs. Port Type
Port-based mode
MAC-based mode
To configure an AP Ethernet port as an 802.1X authenticator
1. Go to Configure > Access Points and click the Edit link next to the AP whose ports you
want to configure.
2. Locate the Port Setting section and select Override Group Config. The screen changes to
display the AP's Ethernet ports.
3. For Type, select Access Port.
4. For 802.1X, select Authenticator (MAC-based) or Authenticator (Port-based).
• In Port-based mode, only a single MAC host must be authenticated for all hosts to be
granted access to the network.
• In MAC-based mode, each MAC host is individually authenticated. Each newly-learned
MAC address triggers an EAPOL request-identify frame.
– Guest VLAN: (Default disabled). When a station fails to authenticate to this port, it
will be assigned to this "guest" VLAN, with access to Internet but not to internal
resources.
– Dynamic VLAN: (Default disabled). Dynamically assign VLANs based on the policies
set on the RADIUS server.
– Authenticator: Select the RADIUS server from the list. A RADIUS server must be
selected to set this port as a MAC-based authenticator.
5. Enable MAC authentication bypass: Enable this option to allow AAA server queries using
the MAC address as both the user name and password. If MAC authentication is unsuc-
cessful, the normal 802.1X authentication exchange is attempted.
Trunk Port Access Port
X
Managing Access Points
Working with Access Point Groups
General Port
X X
X
165