Table of Contents
Advertisement
The Internal Authentication Server feature provides support for the creation
of users for IEEE 802.1x access only, i.e. without switch management access.
This feature maintains a separate database of users allowed for 802.1x access.
The authentication method internal is available in the list of methods
supported by authentication to support user database lookup. The internal
method cannot be added in the same authentication list that has other
methods like local, radius and reject.
Whenever an operator configures a port in 802.1x authentication mode and
selects the authentication method as internal, then the user credentials
received from the 802.1x supplicant are validated against the user database by
the 802.1x component. The 802.1x application accesses the 802.1x user
database to check whether the user credentials present in the authentication
message corresponds to a valid user or not. If so then an event is generated
which triggers the 802.1x state machine to send a challenge to the supplicant.
Otherwise a failure is returned to the 802.1x state machine and the user is not
granted access to the port.
If user(s) credentials are changed, the existing user connection(s) are not
disturbed and the changed user(s) credentials are only used when a new EAP
request arises.
A CLI configuration mode is added in order to configure 802.1x users and
their attributes. The 802.1x maintained user database can also be exported
(uploaded) or imported (downloaded) to/from a central location using a
TFTP server. Use the aaa ias-user username command to add users to the
internal database.
MAC Authentication Bypass
Today, IEEE 802.1x has become the recommended port-based authentication
method at the access layer in enterprise networks. However, there may be
802.1x unaware devices such as printers, fax-machines, etc., that would
require access to the network without 802.1x authentication. MAC
Authentication Bypass (MAB) is a supplemental authentication mechanism
to allow 802.1x unaware clients to authenticate to the network. It uses the
802.1x infrastructure. MAB cannot be supported independently of the 802.1x
component.
842
Security Commands
Advertisement
Table of Contents
