PureStream PureLink VIP-NET-M28A Media Hub, User Manual

Page: 146 / 196

VIP-NET-M28A Network Switch - USER MANUAL
VERSION 1.0
authenticator (the switch) does not need to know which
authentication method the supplicant and the authentication
server are using, or how many information exchange frames
are needed for a particular method. The switch simply
encapsulates the EAP part of the frame into the relevant type
(EAPOL or RADIUS) and forwards it.
When authentication is complete, the RADIUS server sends a
special packet containing a success or failure indication.
Besides forwarding the result to the supplicant, the switch uses
it to open up or block traffic on the switch port connected to the
supplicant.
Note: in an environment where two backend servers are
enabled, the server timeout is configured to X seconds (using
the authentication configuration page), and the first server in the
list is currently down (but not considered dead), if the supplicant
retransmits EAPOL Start frames at a rate faster than X
seconds, it will never be authenticated because the switch will
cancel on-going backend authentication server requests
whenever it receives a new EAPOL Start frame from the
supplicant. Since the server has not failed (because the X
seconds have not expired), the same server will be contacted
when the next backend authentication server request from the
switch This scenario will loop forever. Therefore, the server
timeout should be smaller than the supplicant's EAPOL Start
frame retransmission rate.
a. Single 802.1X
In port-based 802.1X authentication, once a supplicant is
successfully authenticated on a port, the whole port is opened
for network traffic. This allows other clients connected to the
port (for instance through a hub) to piggy-back on the
successfully authenticated client and get network access even
though they are not authenticated individually. To overcome this
security breach, use the Single 802.1X variant.
Single 802.1X is not yet an IEEE standard, but features many
of the same characteristics as port-based 802.1X. In Single
802.1X, at most one supplicant can get authenticated on the
port at a time. Normal EAPOL frames are used in the
communications between the supplicant and the switch. If more
than one supplicant are connected to a port, the one that comes
first when the port's link is connected will be the first one
considered. If that supplicant does not provide valid credentials
within a certain amount of time, the chance will be given to
another supplicant. Once a supplicant is successfully
authenticated, only that supplicant will be allowed access. This
is the most secure of all the supported modes. In this mode, the
Port Security module is used to secure a supplicant's MAC
address once successfully authenticated.
b. Multi 802.1X
In port-based 802.1X authentication, once a supplicant is
successfully authenticated on a port, the whole port is opened
for network traffic. This allows other clients connected to the
port (for instance through a hub) to piggy-back on the
successfully authenticated client and get network access even
though they are not authenticated individually. To overcome this
security breach, use the Multi 802.1X variant.
Multi 802.1X is not yet an IEEE standard, but features many of