MRV Communications MRW55, User Manual

Page: 71 / 244

Advanced Configuration
6-13
6
server. Client authentication is then verified on the RADIUS server before the
access point grants client access to the network.
The 802.1X EAP packets are also used to pass dynamic unicast session keys and
static broadcast keys to wireless clients. Session keys are unique to each client and
are used to encrypt and correlate traffic passing between a specific client and the
access point. You can also enable broadcast key rotation, so the access point
provides a dynamic broadcast key and changes it at a specified interval.
You can enable 802.1X as optionally supported or as required to enhance the
security of the wireless network.
• Disable: The access point does not support 802.1X authentication for any wireless
client. After successful wireless association with the access point, each client is
allowed to access the network.
• Supported: The access point supports 802.1X authentication only for clients
initiating the 802.1X authentication process (i.e., the access point does not initiate
802.1X authentication). For clients initiating 802.1X, only those successfully
authenticated are allowed to access the network. For those clients not initiating
802.1X, access to the network is allowed after successful wireless association with
the access point.
• Required: The access point enforces 802.1X authentication for all associated
wireless clients. If 802.1X authentication is not initiated by a client, the access point
will initiate authentication. Only those clients successfully authenticated with
802.1X are allowed to access the network.
When 802.1X is enabled, the broadcast and session key rotation intervals can also
be configured.
• Broadcast Key Refresh Rate: Sets the interval at which the broadcast keys are
refreshed for stations using 802.1X dynamic keying. (Range: 0-1440 minutes;
Default: 0 means disabled)
• Session Key Refresh Rate: The interval at which the access point refreshes
unicast session keys for associated clients. (Range: 0-1440 minutes; Default: 0
means disabled)
• 802.1X Re-authentication Refresh Rate: The time period after which a connected
client must be re-authenticated. During the re-authentication process of verifying
the client’s credentials on the RADIUS server, the client remains connected the
network. Only if re-authentication fails is network access blocked. (Range: 0-65535
seconds; Default: 0 means disabled)