iES26GF
User’s
Manual
UM-iES26GF-1.2.3-EN.docx
Pages 124 of 169
encapsulates the EAP part of the frame into the relevant type (EAPOL or RADIUS)
and forwards it.
When authentication is complete, the RADIUS server sends a special packet
containing a success or failure indication. Besides forwarding the result to the
supplicant, the switch uses it to open up or block traffic on the switch port
connected to the supplicant.
Note: in an environment where two backend servers are enabled, the server
timeout is configured to X seconds (using the authentication configuration
page), and the first server in the list is currently down (but not considered
dead), if the supplicant retransmits EAPOL Start frames at a rate faster than X
seconds, it will never be authenticated because the switch will cancel on-going
backend authentication server requests whenever it receives a new EAPOL Start
frame from the supplicant. Since the server has not failed (because the X
seconds have not expired), the same server will be contacted when the next
backend authentication server request from the switch This scenario will loop
forever. Therefore, the server timeout should be smaller than the supplicant's
EAPOL Start frame retransmission rate.
Single 802.1X
In port-based 802.1X authentication, once a supplicant is successfully
authenticated on a port, the whole port is opened for network traffic. This allows
other clients connected to the port (for instance through a hub) to piggy-back
on the successfully authenticated client and get network access even though
they are not authenticated individually. To overcome this security breach, use
the Single 802.1X variant.
Single 802.1X is not yet an IEEE standard, but features many of the same
characteristics as port-based 802.1X. In Single 802.1X, at most one supplicant
can get authenticated on the port at a time. Normal EAPOL frames are used in
the communications between the supplicant and the switch. If more than one
supplicant is connected to a port, the one that comes first when the port's link is
connected will be the first one considered. If that supplicant does not provide
valid credentials within a certain amount of time, the chance will be given to
another supplicant. Once a supplicant is successfully authenticated, only that
supplicant will be allowed access. This is the most secure of all the supported
modes. In this mode, the Port Security module is used to secure a supplicant's
MAC address once successfully authenticated.
4.
Multi 802.1X
In port-based 802.1X authentication, once a supplicant is successfully
authenticated on a port, the whole port is opened for network traffic. This allows
other clients connected to the port (for instance through a hub) to piggy-back
on the successfully authenticated client and get network access even though
they are not authenticated individually. To overcome this security breach, use
the Multi 802.1X variant.
Multi 802.1X is not yet an IEEE standard, but features many of the same
characteristics as port-based 802.1X. In Multi 802.1X, one or more supplicants
can be authenticated on the same port at the same time. Each supplicant is
authenticated individually and secured in the MAC table using the Port Security
module.
In Multi 802.1X it is not possible to use the multicast BPDU MAC address as the
destination MAC address for EAPOL frames sent from the switch to the
supplicant, since that would cause all supplicants attached to the port to reply to
requests sent from the switch. Instead, the switch uses the supplicant's MAC
address, which is obtained from the first EAPOL Start or EAPOL Response
Identity frame sent by the supplicant. An exception to this is when no supplicants
are attached. In this case, the switch sends EAPOL Request Identity frames using
the BPDU multicast MAC address as destination - to wake up any supplicants that
might be on the port.
The maximum number of supplicants that can be attached to a port can be
limited using the Port Security Limit Control functionality.
