IGPS-9080 Series User Manual
ORing Industrial Networking Corp
127
the server timeout is configured to X seconds (using the
authentication configuration page), and the first server in the list is
currently down (but not considered dead), if the supplicant
retransmits EAPOL Start frames at a rate faster than X seconds, it
will never be authenticated because the switch will cancel
on-going backend authentication server requests whenever it
receives a new EAPOL Start frame from the supplicant. Since the
server has not failed (because the X seconds have not expired),
the same server will be contacted when the next backend
authentication server request from the switch This scenario will
loop forever. Therefore, the server timeout should be smaller than
the supplicant's EAPOL Start frame retransmission rate.
a. Single 802.1X
In port-based 802.1X authentication, once a supplicant is
successfully authenticated on a port, the whole port is opened for
network traffic. This allows other clients connected to the port (for
instance through a hub) to piggy-back on the successfully
authenticated client and get network access even though they are
not authenticated individually. To overcome this security breach,
use the Single 802.1X variant.
Single 802.1X is not yet an IEEE standard, but features many of
the same characteristics as port-based 802.1X. In Single 802.1X,
at most one supplicant can get authenticated on the port at a time.
Normal EAPOL frames are used in the communications between
the supplicant and the switch. If more than one supplicant are
connected to a port, the one that comes first when the port's link is
connected will be the first one considered. If that supplicant does
not provide valid credentials within a certain amount of time, the
chance will be given to another supplicant. Once a supplicant is
successfully authenticated, only that supplicant will be allowed
access. This is the most secure of all the supported modes. In this
mode, the Port Security module is used to secure a supplicant's
MAC address once successfully authenticated.
b. Multi 802.1X
In port-based 802.1X authentication, once a supplicant is
successfully authenticated on a port, the whole port is opened for
network traffic. This allows other clients connected to the port (for
