AirLive POE-GSH1008R-130, User Manual, Page: 197 / 270

4.Web Management: System of POE-GSH1008R-130
193
AirLive POE-GSH1008R-130 User Manual
Now, if the supplicant
retransmits EAPOL Start
frames at a rate faster than
X seconds, then it will never
get authenticated, because
the switch will cancel
on-going backend
authentication server
requests whenever it
receives a new EAPOL Start
frame from the supplicant.
And since the server hasn't
yet failed (because the X
seconds haven't expired),
the same server will be
contacted upon the next
backend authentication
server request from the
switch. This scenario will
loop forever. Therefore, the
server timeout should be
smaller than the supplicant's
EAPOL Start frame
retransmission rate.
19. Single 802.1X :
In port-based 802.1X authentication, once a supplicant is successfully
authenticated on a port, the whole port is opened for network traffic. This allows
other clients connected to the port (for instance through a hub) to piggy-back on
the successfully authenticated client and get network access even though they
really aren't authenticated. To overcome this security breach, use the Single
802.1X variant. Single 802.1X is really not an IEEE standard, but features many of
the same characteristics as does port-based 802.1X. In Single 802.1X, at most
one supplicant can get authenticated on the port at a time. Normal EAPOL frames
are used in the communication between the supplicant and the switch. If more
than one supplicant is connected to a port, the one that comes first when the port's
link comes up will be the first one considered. If that supplicant doesn't provide
valid credentials within a certain amount of time, another supplicant will get a
chance. Once a supplicant is successfully authenticated, only that supplicant will
be allowed access. This is the most secure of all the supported modes. In this
mode, the Port Security module is used to secure a supplicant's MAC address
once successfully authenticated.
20. Multi 802.1X :
In port-based 802.1X authentication, once a supplicant is successfully
authenticated on a port, the whole port is opened for network traffic. This allows
other clients connected to the port (for instance through a hub) to piggy-back on
the successfully authenticated client and get network access even though they
really aren't authenticated. To overcome this security breach, use the Multi 802.1X
variant.