Advanced EAPOL features
29
Only unicast packets are sent to a specific port so that the packets
reach the correct destination.
•
Receiving EAPOL packets
The EAPOL packets are directed to the correct logical port for state
machine action.
•
Traffic on an authorized port
Only a set of authorized MAC addresses is allowed access to a port.
MHMA support for EAP clients includes the following features:
•
A port remains on the Guest VLAN when no authenticated hosts exist
on it. Until the first authenticated host, both EAP and non EAP clients
are allowed on the port.
•
After the first successful authentication, only EAPOL packets and data
from the authenticated MAC addresses are allowed on a particular port.
•
Only a predefined number of authenticated MAC users are allowed on
a port.
•
When RADIUS VLAN assignment is disabled for ports in MHMA mode,
only preconfigured VLAN assignment for the port is used. Upon
successful authentication, untagged traffic is put it in a VLAN configured
for the port.
•
When RADIUS VLAN assignment is enabled for ports in MHMA mode,
upon successful RADIUS authentication, the port gets a VLAN value in
a RADIUS Attribute with EAP success. The port is added and the PVID
is set to the first such VLAN value from the RADIUS server.
•
Configuration of timer parameters is per physical port, not per user
session. However, the timers are used by the individual sessions on
the port.
•
Reauthenticate Now, when enabled, causes all sessions on the port to
reauthenticate.
•
Reauthentication timers are used to determine when a MAC is
disconnected so as to enable another MAC to log in to the port.
•
Configuration settings are saved across resets.
Radius-assigned VLAN use in MHMA mode
Radius-assigned VLAN use in the MHMA mode is allowed to give you
greater flexibility and a more centralized assignment than existed. This
feature is also useful in an IP Phone set up, when the phone traffic can
be directed to the Voice over IP (VoIP) VLAN and the PC Data traffic can
be directed to the assigned VLAN. When Radius-assigned VLAN values
are allowed, the port behaves as follows: the first authenticated EAP MAC
Nortel Ethernet Routing Switch 2500 Series
Security — Configuration and Management
NN47215-505 (323165-B)
02.01
Standard
4.1
19 November 2007
Copyright © 2007, Nortel Networks
.
Summary of Contents for 2526T
Page 227: ......
