Port Security Concepts; Static Mac Address-Based Authentication; Ieee 802.1X Authentication - Siemens RUGGEDCOM ROS User Manual

Chapter 5
Setup and Configuration
that received the frame can be shutdown permanently or for a specified period of time. An alarm will be raised
indicating the detected unauthorized MAC address.
Frames to unknown destination addresses are flooded through secure ports.
The following sections describe how to configure and manage port security:
• Section 5.10.1, "Port Security Concepts"
• Section 5.10.2, "Viewing a List of Authorized MAC Addresses"
• Section 5.10.3, "Configuring Port Security"
• Section 5.10.4, "Configuring IEEE 802.1X"
Section 5.10.1

Port Security Concepts

The following sections describe some of the concepts important to the implementation of port security in ROS:
• Section 5.10.1.1, "Static MAC Address-Based Authentication"
• Section 5.10.1.2, "IEEE 802.1x Authentication"
• Section 5.10.1.3, "IEEE 802.1X Authentication with MAC Address-Based Authentication"
• Section 5.10.1.4, "Assigning VLANS with Tunnel Attributes"
Section 5.10.1.1

Static MAC Address-Based Authentication

With this method, the switch validates the source MAC addresses of received frames against the contents in the
Static MAC Address Table.
ROS also supports a highly flexible Port Security configuration which provides a convenient means for network
administrators to use the feature in various network scenarios.
A Static MAC address can be configured without a port number being explicitly specified. In this case, the
configured MAC address will be automatically authorized on the port where it is detected. This allows devices to
be connected to any secure port on the switch without requiring any reconfiguration.
The switch can also be programmed to learn (and, thus, authorize) a pre-configured number of the first source
MAC addresses encountered on a secure port. This enables the capture of the appropriate secure addresses
when first configuring MAC address-based authorization on a port. Those MAC addresses are automatically
inserted into the Static MAC Address Table and remain there until explicitly removed by the user.
Section 5.10.1.2

IEEE 802.1x Authentication

The IEEE 802.1x standard defines a mechanism for port-based network access control and provides a means of
authenticating and authorizing devices attached to LAN ports.
Although IEEE 802.1x is mostly used in wireless networks, this method is also implemented in wired switches.
The IEEE 802.1x standard defines three major components of the authentication method: Supplicant,
Authenticator and Authentication server. ROS supports the Authenticator component.
216
RUGGEDCOM ROS
User Guide
Port Security Concepts