802.1X; Important Points To Remember - Dell Force10 Z9000 Reference Manual

802.1X

An authentication server must authenticate a client connected to an 802.1X switch port. Until the authentication, only
extensible authentication protocol over LAN (EAPOL) traffic is allowed through the port to which a client is connected.
After authentication is successful, normal traffic passes through the port.
The Dell Force10 operating software (FTOS) supports remote authentication dial-in service (RADIUS) and active
directory environments using 802.1X Port Authentication.

Important Points to Remember

FTOS limits network access for certain users by using virtual local area network (VLAN) assignments. 802.1X with VLAN
assignment has these characteristics when configured on the switch and the RADIUS server.
• 802.1X is supported on C-Series, E-Series, S-Series (S25/S50), S4810, and E-Series Terascale.
• On all platforms, if the primary RADIUS server becomes unresponsive, the authenticator begins using a
secondary RADIUS server, if configured.
• If no VLAN is supplied by the RADIUS server or if you disable 802.1X authorization, the port configures in its
access VLAN after successful authentication.
• If you enable 802.1X authorization but the VLAN information from the RADIUS server is not valid, the port returns
to the Unauthorized state and remains in the configured access VLAN. This safeguard prevents ports from
appearing unexpectedly in an inappropriate VLAN due to a configuration error. Configuration errors create an
entry in Syslog.
• If you enable 802.1X authorization and all information from the RADIUS server is valid, the port is placed in the
specified VLAN after authentication.
• If you enable port security on an 802.1X port with VLAN assignment, the port is placed in the RADIUS server
assigned VLAN.
• If you disable 802.1X on the port, it returns to the configured access VLAN.
• When the port is in the Force Authorized, Force Unauthorized, or Shutdown state, it is placed in the configured
access VLAN.
• If an 802.1X port is authenticated and put in the RADIUS server assigned VLAN, any change to the port access
VLAN configuration does not take effect.
• The 802.1X with VLAN assignment feature is not supported on trunk ports, dynamic ports, or with dynamic-
access port assignment through a VLAN membership.
5
195