3Com Switch 7754, Configuration Manual

Page: 398 / 940

398 C
HAPTER
39: 802.1
X
C
ONFIGURATION
■
The 802.1x clients are capable of detecting multi-network adapter, proxies, and
IE proxies.
■
CAMS is configured to disable the use of multiple network adapters, proxies, or
IE proxies.
By default, an 802.1x client program allows use of multiple network adapters, a
proxy server, and an IE proxy server. If CAMS is configured to disable use of
multiple network adapters, proxies, or IE proxies, it prompts the 802.1x client to
disable use of multiple network adapters, proxies, or IE proxies through messages
after the supplicant system passes the authentication.
n
■
The client-checking function needs the support of 3Com’s 802.1x client
program.
■
The proxy detecting function should be enabled on both the 802.1x client
program and CAMS. The client version detecting should be enabled on the
switch (achieved via the
dot1x version-check command).
Client version detection
With the 802.1x client-version-checking function enabled, a switch will check the
version and validity of an 802.1x client to prevent unauthorized users or users with
earlier versions of 802.1x from logging in.
This function makes the switch to send version-requesting packets again if the
802.1x client fails to send version-reply packet to the switch before the
version-checking timer times out.
n
The client-version-checking function needs the support of 3Com’s 802.1x client
program.
The Guest VLAN function
The Guest VLAN function enables supplicant systems that do not pass the
authentication to access a LAN in a restrained way.
With the Guest VLAN function enabled, supplicant systems that do not have
802.1x client installed can access specific network resources. They can also
upgrade their 802.1x clients without being authenticated.
With this function enabled:
■
The switch multicasts trigger packets to all 802.1x-enabled ports.
■
After the maximum number retries have been made and there are still ports
that have not sent any response back, the switch will then add these ports into
the Guest VLAN.
■
Users belonging to the Guest VLAN can access the resources of the Guest
VLAN without being authenticated. But they need to be authenticated before
accessing external resources.
Normally, the Guest VLAN function is coupled with the dynamic VLAN delivery
function.
Refer to “Configuring Dynamic VLAN Assignment” on page 522 for detailed
information about dynamic VLAN assignment function.