CTC Union GSW-3420FM, User Manual

Page: 49 / 145

prevents unauthorized access to a network by requiring users to first submit
credentials for authentication. One or more central servers, the backend servers,
determine whether the user is allowed access to the network. These backend
(RADIUS) servers are configured on the "Configuration→Security→AAA" page.
The IEEE802.1X standard defines port-based operation, but non-standard
variants overcome security limitations as shall be explored below.
MAC-based authentication allows for authentication of more than one user on
the same port, and doesn't require the user to have special 802.1X supplicant
software installed on his system. The switch uses the user's MAC address to
authenticate against the backend server. Intruders can create counterfeit MAC
addresses, which makes MAC-based authentication less secure than 802.1X
authentication.
Configuration by Web :
[Configuration] -> [Security] -> [Network] -> [NAS]
Click “
?
” at this web page to get details of the settings.
Configuration by Command :
Enable/Disable :
(config)# dot1x system-auth-control
(config)# no dot1x system-auth-control
RADIUS-Assigned QoS / RADIUS-Assigned VLAN / Guest VLAN Enabled :
(config)# dot1x feature { [ guest-vlan ] [ radius-qos ] [ radius-vlan ] }*1
(config)# no dot1x feature { [ guest-vlan ] [ radius-qos ] [ radius-vlan ] }*1
For Guest VLAN ...
Guest VLAN ID / Max. Reauth. Count / Allow Guest VLAN if EAPOL Seen :
46