Chapter 4: Operation of Web-based Management
724-746-5500 | blackbox.com
113
Port No: 1–8
VID: VLAN ID: 1–4094
Add: Input MAC, IP, Port and VID, then click on <Add> to create a new entry into the IP MAC Binding table
Figure 135. IP MAC binding dynamic entry.
Delete: Select one of entry from the table, then click on <Delete> to delete this entry.
4.12 802.1X Configuration
802.1X port-based network access control provides a method to restrict users from gaining access to the network resources through a
802.1X-enabled port without authentication. If a user wants to connect to the network through a port under 802.1X control, he must
input his account name for authentication and gain authorization before sending or receiving any packets from a 802.1X-enabled
port.
Before the devices or end stations can access the network resources through the ports under 802.1X control, the devices or end
stations connected to a controlled port send the authentication request to the authenticator. The authenticator passes the request to
the authentication server to authenticate and verify. The server tells the authenticator if the request is authorized for the ports.
According to IEEE802.1X, there are three components implemented. They are Authenticator, Supplicant, and Authentication server.
Supplicant: An entity being authenticated by an authenticator. It is used to communicate with the Authenticator PAE (Port Access
Entity) by exchanging the authentication message when the Authenticator PAE requests it.
Authenticator: An entity facilitates the authentication of the supplicant entity. It controls the state of the port, authorized or
unauthorized, according to the result of the authentication message exchanged between it and a supplicant PAE.
The authenticator may request that the supplicant re-authenticate itself at a configured time period. Once re-authenticating the
supplicant starts, the controlled port stays in the authorized state until re-authentication fails.
A port acting as an authenticator is two logical ports, a controlled port and an uncontrolled port. A controlled port can only pass the
packets when the authenticator PAE is authorized. An uncontrolled port will unconditionally pass the packets with PAE group MAC
address, which has the value of 01-80-c2-00-00-03 and will not be forwarded by a MAC bridge.
Authentication server: A device provides authentication service, through EAP, to an authenticator by using authentication credentials
supplied by the supplicant to determine if the supplicant is authorized to access the network resource.
Operation flow is shown in Figure 3-53. When a Supplicant PAE issues a request to an Authenticator PAE, Authenticator and
Supplicant exchange an authentication message. Then, Authenticator passes the request to RADIUS server to verify. Finally, RADIUS
server replies if the request is granted or denied.
While in the authentication process, the message packets, encapsulated by Extensible Authentication Protocol over LAN (EAPOL), are
exchanged between an authenticator PAE and a supplicant PAE. The Authenticator exchanges the message with an authentication
