Black Box LE2700A, User Manual, Page: 110 / 154

724-746-5500 | blackbox.com
Page 110
Chapter 5: Management
Table 5-80 (continued). Network Access Server Configuration screen options.
Label Description
Admin State
(continued) Port-based 802.1X
In an 802.1X network environment, the user is called the supplicant, the switch is the authenticator, and the
RADIUS server is the authentication server. The authenticator acts as the man-in-the-middle, forwarding
requests and responses between the supplicant and the authentication server. Frames sent between the
supplicant and the switch are special 802.1X frames, known as EAPOL (EAP Over LANs) frames which
encapsulate EAP PDUs (RFC3748). Frames sent between the switch and the RADIUS server is RADIUS pack-
ets. RADIUS packets also encapsulate EAP PDUs together with other attributes like the switch's IP address,
name, and the supplicant's port number on the switch. EAP is very flexible as it allows for different authenti-
cation methods, like MD5-Challenge, PEAP, and TLS. The important thing is that the authenticator (the
switch) does not need to know which authentication method the supplicant and the authentication server
are using, or how many information exchange frames are needed for a particular method. The switch simply
encapsulates the EAP part of the frame into the relevant type (EAPOL or RADIUS) and forwards it.
When authentication is complete, the RADIUS server sends a special packet containing a success or failure
indication. Besides forwarding the result to the supplicant, the switch uses it to open up or block traffic on
the switch port connected to the supplicant.
NOTE: In an environment where two backend servers are enabled, the server timeout is configured to X sec-
onds (using the authentication configuration page), and the first server in the list is currently down
(but not considered dead), if the supplicant retransmits EAPOL Start frames at a rate faster than X
seconds, it will never be authenticated because the switch will cancel on-going backend
authentication server requests whenever it receives a new EAPOL Start frame from the supplicant.
Since the server has not failed (because the X seconds have not expired), the same server will be
contacted when the next backend authentication server request from the switch This scenario will
loop forever. Therefore, the server timeout should be smaller than the supplicant's EAPOL Start frame
retransmission rate.
a. Single 802.1X
In port-based 802.1X authentication, once a supplicant is successfully authenticated on a port, the whole
port is opened for network traffic. This allows other clients connected to the port (for instance through a
hub) to piggy-back on the successfully authenticated client and get network access even though they are
not authenticated individually. To overcome this security breach, use the Single 802.1X variant.
Single 802.1X is not yet an IEEE standard, but features many of the same characteristics as port-based
802.1X. In Single 802.1X, at most one supplicant can get authenticated on the port at a time. Normal
EAPOL frames are used in the communications between the supplicant and the switch. If more than one
supplicant are connected to a port, the one that comes first when the port's link is connected will be the
first one considered. If that supplicant does not provide valid credentials within a certain amount of time, the
chance will be given to another supplicant. Once a supplicant is successfully authenticated, only that suppli-
cant will be allowed access. This is the most secure of all the supported modes. In this mode, the Port
Security module is used to secure a supplicant's MAC address once successfully authenticated.
b. Multi 802.1X
In port-based 802.1X authentication, once a supplicant is successfully authenticated on a port, the whole
port is opened for network traffic. This allows other clients connected to the port (for instance through a
hub) to piggy-back on the successfully authenticated client and get network access even though they are
not authenticated individually. To overcome this security breach, use the Multi 802.1X variant.