Dell POWERCONNECT 5524, User Manual

Page: 128 / 728

128
Dell PowerConnect 55xx Systems User Guide
The device supports Port Based Authentication via RADIUS servers.
Dot1x Overview
Dot1x is an IEEE standard for port-based network access control. The Dot1x
framework enables a device (the supplicant) to request port access from a
remote device (authenticator) to which it is connected. The supplicant is
permitted to send data to the port only after it is authenticated and
authorized. If it is not authenticated and authorized, the authenticator
discards the supplicant data, unless the data is sent to a Guest VLAN and/or
non-authenticated VLANs.
Authentication of the supplicant is performed by an external RADIUS server
through the authenticator. The authenticator monitors the results of the
authentication.
In the Dot1x standard, a device can be a supplicant and an authenticator at a
port, simultaneously requesting and granting port access. However, this
device can only act as an authenticator, and does not take on the role of a
supplicant.
The following varieties of Dot1x exist:
• Single session Dot1x:
– A1—Single-session/Single Host — In this mode, the switch, as an
authenticator, supports a single Dot1x session, and grants permission
to use the port to an authorized supplicant. All other access requests,
made by other devices received from the same port, are denied until
the authorized supplicant is no longer using the port, or the access
request is to an unauthenticated or guest VLAN.
– Single-session/Multiple Hosts —This follows the Dot1x standard. In
this mode, the switch, as an authenticator, enables any device to use a
port, as long as it has been granted permission as a supplicant at the
port.
• Multi-Session Dot1x —Every device (supplicant) connecting to a port
must be authenticated and authorized by the switch (authenticator),
separately in a different Dot1x session. This is the only mode that supports
Dynamic VLAN Assignment (DVA).