Security Configuration Command Set
Configuring 802.1X Authentication
Matrix NSA Series Configuration Guide
14-39
14.3.5 Configuring 802.1X Authentication
About Multi-User Authentication
Enterasys Networks’ enhanced version of the IEEE 802.1X-2001 specification decreases security
vulnerabilities inherent with the standard implementation, and allows multiple devices and users,
also known as “supplicants,” to be authenticated on a single port. The enhanced standard clearly
distinguishes each network access port from its access “entities,” which maintain authentication
instructions associated with each unique potential supplicant.
802.1X enhancements are backwards-compatible with existing 802.1X supplicants and
configurations, and are designed to seamlessly integrate into Enterasys’ per-user policy
management system; allowing much more granular control over user authorization.
The Enterasys multi-user 802.1X implementation includes the following components:
•
A Multi-Mode Enabled Matrix System—only when a system is set to operate in multiple
authentication mode (as described in
Section 14.3.10
) can the enhanced 802.1X feature be used.
The system's ports intended for network access to authenticate and authorize supplicants will be
allowed to simultaneously utilize more than one access entity.
•
Access Entities—responsible for maintaining state, counters, and statistics for an individual
supplicant. An access entity is activated from a pool of configured access entities when a
potential supplicant on a port needs to be authenticated. It becomes deactivated when the
supplicant logs off, cannot be authenticated, or the Matrix device determines that the supplicant
or associated policy settings are no longer valid.
•
Supplicants—devices or users that desire access to the network, such as workstations, printers,
PDAs, or hard-wired or wireless phones. These will be identified by the system using a
combination of connection port, MAC addresses, and allocated access entity index. Once a
supplicant is successfully authenticated, the system is responsible for enforcing the degree to
which the supplicant will be authorized to access the network, using information sent to it by the
authentication server.
•
Authentication Server—typically a RADIUS authority, where the Matrix system and server
have mutually-configured knowledge of one another.
Purpose
To review and configure 802.1X authentication for one or more ports using EAPOL (Extensible
Authentication Protocol). 802.1X controls network access by enforcing user authorization on
selected ports, which results in allowing or denying network access according to RADIUS server
configuration.