214
NOTE:
Supposed two backend servers are enabled and
that the server timeout is configured to X seconds
(using the AAA configuration page). Also supposed that
the first server in the list is currently down (but not
considered dead).
Now, if the supplicant retransmits EAPOL start frames
at a rate faster than X seconds, then it will never get
authenticated because the switch will cancel on-going
backend authentication server requests whenever it
receives a new EAPOL start frame from the supplicant.
Since the server hasn't failed yet (because the X
seconds haven't expired), the same server will be
contacted upon the next backend authentication server
request from the switch. This scenario will loop
forever. Therefore, the server timeout should be
smaller than the supplicant's EAPOL start frame
retransmission rate.
Single 802.1X:
Once a supplicant is successfully authenticated on a port in a
port
-
based 802.1X authentication, the whole port is opened for network
traffic. This allows other clients connected to the port (e.g. through a hub)
to piggy
-
back on the successfully authenticated client and get network
access even though they aren't really authenticated. To overcome this
security breach, use the Single 802.1X variant. Single 802.1X is really not an
IEEE standard, but features many of the same characteristics as does port
-
based 802.1X. In Single 802.1X, only one supplicant can get authenticated
on the port at a time. Normal EAPOL frames are used in the communication
between the supplicant and the switch. If more than one supplicant is
connected to a port, the one that comes first when the port's link comes up
will be the first one considered. If that supplicant doesn't provide valid
credentials within a certain amount of time, another supplicant will get a
chance. Once a supplicant is successfully authenticated, only that
supplicant will be allowed access. This is the most secured mode. In this
mode, the port security module is used to secure a supplicant's MAC
address once it’s successfully authenticated.
Multi 802.1X:
Once a supplicant is successfully authenticated on a port in a
port
-
based 802.1X authentication, the whole port is opened for network
traffic. This allows other clients connected to the port (e.g. through a hub)
to piggy
-
back on the successfully authenticated client and get network
access even though they aren't authenticated. To overcome this security
breach, use the Multi 802.1X variant. Multi 802.1X is, like Single 802.1X, not
an IEEE standard but a variant that features many of the same
characteristics. In Multi 802.1X, one or more supplicants can get
authenticated on the same port at the same time. Each supplicant is
authenticated individually and secured in the MAC table using the port
security module.
