Operation Manual - Security
Quidway S3000 Series Ethernet Switches
Chapter 1 802.1x Configuration
1-3
z
EAPoL-Start: Authentication originating frame, actively originated by the
Supplicant.
z
EAPoL-Logoff: Logoff request frame, actively terminating the authenticated state.
z
EAPoL-Key: Key information frame, supporting to encrypt the EAP packets.
z
EAPoL-Encapsulated-ASF-Alert: Supports the Alerting message of Alert Standard
Forum (ASF).
The EAPoL-Start, EAPoL-Logoff and EAPoL-Key only exist between the Supplicant
and the Authenticator. The EAP-Packet information is re-encapsulated by the
Authenticator System and then transmitted to the Authentication Server System. The
EAPoL-Encapsulated-ASF-Alert is related to the network management information and
terminated by the Authenticator.
From the above fundamentals we can see that 802.1x provides an implementation
solution of user ID authentication. However, 802.1x itself is not enough to implement
the scheme. The administrator of the access device should configure the AAA scheme
by selecting RADIUS or local authentication so as to assist 802.1x to implement the
user ID authentication. For detailed description of AAA, refer to the corresponding AAA
configuration.
1.1.4 Implement 802.1x on Ethernet Switch
Quidway Series Ethernet Switches not only support the port access authentication
method regulated by 802.1x, but also extend and optimize it in the following way:
z
Support to connect several End Stations in the downstream via a physical port.
z
The access control (or the user authentication method) can be based on port or
MAC address.
In this way, the system becomes much securer and easier to manage.
1.2 Configure 802.1x
The configuration tasks of 802.1x itself can be fulfilled in system view of the Ethernet
switch. When the global 802.1x is not enabled, the user can configure the 802.1x state
of the port. The configured items will take effect after the global 802.1x is enabled.
Note:
1) Do not enable 802.1x and RSTP( or MSTP) simultaneously, otherwise switch may not work normally.
2) When 802.1x is enabled on a port, the max number of MAC address learning which is configured by the
command
mac-address max-mac-count
cannot be configured on the port, and vice versa.
