Digisol DG-GS1550, Management Manual

Page: 125 / 665

User Authentication
3-79
3
CLI – This example enables SSH, sets the authentication parameters, and displays
the current configuration. It shows that the administrator has made a connection via
SHH, and then disables this connection.
Configuring 802.1X Port Authentication
Network switches can provide open and easy access to network resources by
simply attaching a client PC. Although this automatic configuration and access is a
desirable feature, it also allows unauthorized personnel to easily intrude and
possibly gain access to sensitive network data.
The IEEE 802.1X (dot1X) standard defines a port-based access control procedure
that prevents unauthorized access to a network by requiring users to first submit
credentials for authentication. Access to all switch ports in a network can be
centrally controlled from a server, which means that authorized users can use the
same credentials for authentication from any point within the network.
This switch uses the
Extensible Authentication
Protocol over LANs (EAPOL)
to exchange authentication
protocol messages with the
client, and a remote RADIUS
authentication server to verify
user identity and access
rights. When a client (i.e.,
Supplicant) connects to a
switch port, the switch (i.e.,
Authenticator) responds with an EAPOL identity request. The client provides its
identity (such as a user name) in an EAPOL response to the switch, which it
forwards to the RADIUS server. The RADIUS server verifies the client identity and
sends an access challenge back to the client. The EAP packet from the RADIUS
server contains not only the challenge, but the authentication method to be used.
The client can reject the authentication method and request another, depending on
the configuration of the client software and the RADIUS server. The encryption
method used to pass authentication messages can be MD5 (Message-Digest 5),
Console(config)#ip ssh server 4-115
Console(config)#ip ssh timeout 100 4-116
Console(config)#ip ssh authentication-retries 5 4-116
Console(config)#ip ssh server-key size 512 4-117
Console(config)#end
Console#show ip ssh
4-119
SSH Enabled - version 2.0
Negotiation timeout: 120 secs; Authentication retries: 5
Server key size: 512 bits
Console#show ssh
4-120
Connection Version State Username Encryption
0 2.0 Session-Started admin ctos aes128-cbc-hmac-md5
stoc aes128-cbc-hmac-md5
Console#disconnect 0
4-50
Console#
802.1x
client
RADIUS
server
1. Client attempts to access a switch port.
2. Switch sends client an identity request.
3. Client sends back identity information.
4. Switch forwards this to authentication server.
5. Authentication server challenges client.
6. Client responds with proper credentials.
7. Authentication server approves access.
8. Switch grants client access to this port.