PureStream PureLink VIP-NET-M28A Media Hub, User Manual

Page: 145 / 196

VIP-NET-M28A Network Switch - USER MANUAL
VERSION 1.0
EAPOL frames.
Valid range of the value is 1 to 65535 seconds. This has no
effect for MAC-based ports.
Age Period
This setting applies to the following modes, i.e. modes using the
Port Security functionality to secure MAC addresses:
MAC-Based Auth .:
When the NAS module uses the Port Security module to secure
MAC addresses, the Port Security module needs to check for
activity on the MAC address in question at regular intervals and
free resources if no activity is seen within a given period of time.
This parameter controls exactly this period and can be set to a
number between 10 and 1000000 seconds.
For ports in
MAC-based Auth. mode, reauthentication does not
cause direct communications between the switch and the client,
so this will not detect whether the client is still attached or not,
and the only way to free any resources is to age the entry.
Hold Time
This setting applies to the following modes, i.e. modes using the
Port Security functionality to secure MAC addresses:
MAC-Based Auth .:
If a client is denied access - either because the RADIUS server
denies the client access or because the RADIUS server request
times out (according to the timeout specified on the
"
Configuration
→
Security
→
AAA " page) - the client is put on
hold in Unauthorized state. The hold timer does not count
during an on-going authentication.
The switch will ignore new frames coming from the client during
the hold time.
The hold time can be set to a number between 10 and 1000000
seconds.
Port The port number for which the configuration below applies
Admin State
If NAS is globally enabled, this selection controls the port's
authentication mode. The following modes are available:
Force Authorized
In this mode, the switch will send one EAPOL Success frame
when the port link is up, and any client on the port will be
allowed network access without authentication.
Force Unauthorized
In this mode, the switch will send one EAPOL Failure frame
when the port link is up, and any client on the port will be
disallowed network access.
Port-based 802.1X
In an 802.1X network environment, the user is called the
supplicant, the switch is the authenticator, and the RADIUS
server is the authentication server. The authenticator acts as
the man-in-the-middle, forwarding requests and responses
between the supplicant and the authentication server. Frames
sent between the supplicant and the switch are special 802.1X
frames, known as EAPOL (EAP Over LANs) frames which
encapsulate EAP PDUs (RFC3748). Frames sent between the
switch and the RADIUS server is RADIUS packets. RADIUS
packets also encapsulate EAP PDUs together with other
attributes like the switch's IP address, name, and the
supplicant's port number on the switch. EAP is very flexible as
it allows for different authentication methods, like MD5-
Challenge, PEAP, and TLS. The important thing is that the