User Manual Managed Switches
195
requests sent from the switch. The maximum number
of supplicants that can be attached to a port can be
limited using the Port Security Limit
Control functionality.
• MAC-based Auth: Unlike port-based 802.1X,
MAC-based authentication is not a standard, but
merely a best-practices method adopted by the
industry. In MAC-based authentication, users are
called clients, and the switch acts as the supplicant on
behalf of clients. The initial frame (any kind of frame)
sent by a client is snooped by the switch, which in turn
uses the client's MAC address as both username and
password in the subsequent EAP exchange with the
RADIUS server. The switch only supports
the MD5-Challenge authentication method, so the
RADIUS server must be configured accordingly.
When authentication is complete, the RADIUS server
sends a success or failure indication, which in turn
causes the switch to open up or block traffic for that
particular client. The advantage of MAC-based
authentication over 802.1X-based authentication is
that the clients don't need special supplicant software
to authenticate. The disadvantage is that MAC
addresses can be spoofed by malicious users -
equipment whose MAC address is a valid RADIUS
user can be used by anyone. Also, only the
MD5-Challenge method is supported. The maximum
number of clients that can be attached to a port can be
limited using the Port Security Limit Control
functionality.
RADIUS-Assigned QoS Enabled
Setting
Description
Factory
Default
Check / Uncheck
When RADIUS-Assigned QoS is both globally
enabled and enabled (checked) on a given port, the
switch reacts to QoS Class information carried in the
RADIUS Access-Accept packet transmitted by the
RADIUS server when a supplicant is successfully
authenticated. If present and valid, traffic received on
the supplicant's port will be classified to the given QoS
Class. This option is only available for single-client
modes (Port-based 802.1X and Single 802.1X).
Unchecked
