Device Security; 802.1X Network Access Control - Dell PowerConnect M6220 Configuration Manual

Device Security

This section describes configuration scenarios for the following features:
• "802.1x Network Access Control" on page 85
• "802.1X Authentication and VLANs" on page 88
• "Authentication Server Filter Assignment" on page 90
• "Access Control Lists (ACLs)" on page 90
• "RADIUS" on page 97
• "TACACS+" on page 100

802.1x Network Access Control

Port-based network access control allows the operation of a system's port(s) to be controlled to
ensure that access to its services is permitted only by systems that are authorized to do so.
Port Access Control provides a means of preventing unauthorized access by supplicants or users to
the services offered by a system. Control over the access to a switch and the LAN to which it is
connected can be desirable in order to restrict access to publicly accessible bridge ports or
departmental LANs.
The PowerConnect 6200 Series switch achieves access control by enforcing authentication of
supplicants that are attached to an authenticator's controlled ports. The result of the authentication
process determines whether the supplicant is authorized to access services on that controlled port.
A PAE (Port Access Entity) can adopt one of two roles within an access control interaction:
• Authenticator – Port that enforces authentication before allowing access to services available via
that Port.
• Supplicant – Port that attempts to access services offered by the Authenticator.
Additionally, there exists a third role:
• Authentication server – Server that performs the authentication function necessary to check the
credentials of the supplicant on behalf of the Authenticator.
Completion of an authentication exchange requires all three roles. The PowerConnect 6200 Series
switch supports the authenticator role only, in which the PAE is responsible for communicating with
the supplicant. The authenticator PAE is also responsible for submitting information received from
the supplicant to the authentication server in order for the credentials to be checked, which
5
85
Device Security