Security Measures
174
Instruction Manual - NXA-ENET8-POE+
The operation of 802.1x on the switch requires the following:
The switch must have an IP address assigned.
RADIUS authentication must be enabled on the switch and the IP address of the RADIUS server specified.
802.1x must be enabled globally for the switch.
Each switch port that will be used must be set to dot1X Auto mode.
Each client that needs to be authenticated must have dot1X client software installed and properly configured.
The RADIUS server and 802.1x client support EAP. (The switch only supports EAPOL in order to pass the EAP packets from
the server to the client.)
The RADIUS server and client also have to support the same EAP authentication type - MD5, PEAP, TLS, or TTLS. (Native
support for these encryption methods is provided in Windows 8, 7, Vista and XP, and in Windows 2000 with Service Pack 4.
To support these encryption methods in Windows 95 and 98, you can use the AEGIS dot1x client or other comparable
client software)
Configuring 802.1x Global Settings
Use the Security > Port Authentication (Configure Global) page to configure IEEE 802.1x port authentication. The 802.1x protocol
must be enabled globally for the switch system before port settings are active.
The following table lists the options on this page:
Perform these steps to configure global settings for 802.1x:
1.
Click
Security
>
Port Authentication
.
2.
Select
Configure Global
from the Step list.
3.
Enable 802.1x globally for the switch.
4.
Click
Apply
.
Configuring Port Authenticator Settings for 802.1x
Use the Security > Port Authentication (Configure Interface - Authenticator) page to configure 802.1x port settings for the switch
as the local authenticator. When 802.1x is enabled, you need to configure the parameters for the authentication process that runs
between the client and the switch (i.e., authenticator), as well as the client identity lookup process that runs between the switch
and authentication server.
Command Usage
When the switch functions as a local authenticator between supplicant devices attached to the switch and the
authentication server, configure the parameters for the exchange of EAP messages between the authenticator and clients
on the Authenticator configuration page.
This switch can be configured to serve as the authenticator on selected ports by setting the Control Mode to Auto on this
configuration page, and as a supplicant on other ports by the setting the control mode to Force-Authorized on this page
and enabling the PAE supplicant on the Supplicant configuration page.
The following table lists the options on this page:
Security - Port Authentication Options
System Authentication Control
Sets the global setting for 802.1x. (Default: Disabled)
Default
Sets all configurable 802.1x global and port settings to their default values.
FIG. 205
Configuring Global Settings for 802.1x Port Authentication
Security - Port Authentication Options
Port
Port number
Status
Indicates if authentication is enabled or disabled on the port. The status is disabled if the control
mode is set to Force-Authorized.
Authorized
Displays the 802.1x authorization status of connected clients.
• Yes - Connected client is authorized.
• N/A - Connected client is not authorized, or port is not connected.