32 Function Description
852-1322/852-1328 Industrial Managed Switch
Manual
1.0.01
6.1.2
RADIUS
The RADIUS is a networking protocol that provides authentication, authorization
and accounting (AAA) management for devices to connect and use a network
services. Figure “RADIUS Authentication Sequence” shows a diagram of
RADIUS authentication sequence.
Figure 9: RADIUS Authentication Sequence
6.1.3
MACSec
WAGO industrial managed switches support advanced security features that
allow traffic encryption and high throughput. MACsec or Media Access Control
Security is a security standard specified by IEEE also called IEEE 802.1AE. This
IEEE MAC security standard provides connectionless user data confidentiality,
frame data integrity, and data origin authenticity. MACsec can establish point-to-
point security on ETHERNET links between directly connected nodes. WAGO
industrial managed switches support this security feature and can be used to
transparently secure an IEEE 802 LAN connection to a peer device (such as
another switch) that also supports the MACsec.
MACsec defines two terms called secure channel and connectivity association
when setting up a secure communication between two switches. A secure
channel in MACsec is unidirectional and used for transmitting (outbound traffic)
or receiving (inbound traffic) data. A connectivity association when MACsec is
enabled consists of two secure channels: one for inbound traffic and one for
outbound traffic.
The point-to-point links can be secured by MACsec after matching security keys
are exchanged and verified between the ports on two different secure switches.
The static secure association key (SAK) security mode is when the user manually
configured the same static secure association key (SAK) on both sides of a
connection. There is no key server in this mode and the keys must be matched
on the ports of both switches. This can be viewed as setting up two secure
channels within a connectivity association. It is suggested to have a periodic
manual key update in order to prevent the key to be broken by brute-force attack.
