Figure 196: Configuring Port Security - Edge-Core ECS4810-12M Layer 2 Management Manual

Hide thumbs Also See for ECS4810-12M Layer 2:

Table of Contents

| Security Measures

Configuring 802.1X Port Authentication

Digest 5), TLS (Transport Layer Security), PEAP (Protected Extensible

Authentication Protocol), or TTLS (Tunneled Transport Layer Security). The

client responds to the appropriate method with its credentials, such as a

password or certificate. The RADIUS server verifies the client credentials

and responds with an accept or reject packet. If authentication is

successful, the switch allows the client to access the network. Otherwise,

non-EAP traffic on the port is blocked or assigned to a guest VLAN based on

the "intrusion-action" setting. In "multi-host" mode, only one host

connected to a port needs to pass authentication for all other hosts to be

granted network access. Similarly, a port can become unauthorized for all

hosts if one attached host fails re-authentication or sends an EAPOL logoff

Figure 196: Configuring Port Security

The operation of 802.1X on the switch requires the following:

The switch must have an IP address assigned.

RADIUS authentication must be enabled on the switch and the IP

address of the RADIUS server specified.

802.1X must be enabled globally for the switch.

Each switch port that will be used must be set to dot1X "Auto" mode.

Each client that needs to be authenticated must have dot1X client

software installed and properly configured.

The RADIUS server and 802.1X client support EAP. (The switch only

supports EAPOL in order to pass the EAP packets from the server to the

The RADIUS server and client also have to support the same EAP

authentication type – MD5, PEAP, TLS, or TTLS. (Native support for

these encryption methods is provided in Windows 7, Vista and XP, and

in Windows 2000 with Service Pack 44. To support these encryption

methods in Windows 95 and 98, you can use the AEGIS dot1x client or

other comparable client software)

1. Client attempts to access a switch port.

2. Switch sends client an identity request.

3. Client sends back identity information.

4. Switch forwards this to authentication server.

5. Authentication server challenges client.

6. Client responds with proper credentials.

7. Authentication server approves access.

8. Switch grants client access to this port.