Cisco 8620, Справочное руководство

Страница: 82 / 100

5-34
Cisco Video Surveillance 8620/8630 IP Camera Reference Guide
Chapter 5 Configuration
Security > IEEE 802.1X
There are three types of rules:
– Single—This rule allows the user to add an IP address to the Allowed/Denied list.
–
Network—This rule allows the user to assign a network address and corresponding subnet mask
to the Allow/Deny List. The address and network mask are written in CIDR format. If IPv6 filter
is preferred, you will be prompted by the Add ipv6 filter list window. Enter the IPv6 address
and the two-digit prefix length to specify the range of IP addresses in your configuration
– Range—This rule allows the user to assign a range of IP addresses to the Allow/Deny List. This
rule only applies to IPv4 addresses
Administrator IP address
•
Always allow the IP address to access this device—You can check this item and add the
Administrator IP address in this field to make sure the Administrator can always connect to the
device.
Security > IEEE 802.1X
Enable this function if your network environment uses IEEE 802.1x, which is a port-based network
access control. The network devices, intermediary switch/access point/hub, and RADIUS server must
support and enable 802.1x settings.
The 802.1x standard is designed to enhance the security of local area networks, which provides
authentication to network devices (clients) attached to a network port (wired or wireless). If all
certificates between client and server are verified, a point-to-point connection will be enabled; if
authentication fails, access on that port will be prohibited. 802.1x utilizes an existing protocol, the
Extensible Authentication Protocol (EAP), to facilitate communication.
The components of a protected network with 802.1x authentication include the following:
• Supplicant—A client end user (camera), which requests authentication
•
Authenticator (an access point or a switch)—A “go between” that restricts unauthorized end users
from communicating with the authentication server
• Authentication server (usually a RADIUS server)—Checks the client certificate and decides
whether to accept the end user access request.
Cameras support two types of EAP methods to perform authentication: EAP-PEAP and EAP-TLS.
To enable 802.1x settings, follow these steps:
Step 1 Before connecting the camera to the protected network with 802.1x, apply a digital certificate from a
Certificate Authority (such as your network administrator) that can be validated by a RADIUS server.
Step 2
Connect the camera to a PC or notebook outside of the protected LAN. Open the configuration page of
the camera. Select EAP-PEAP or EAP-TLS as the EAP method. In the field, enter your ID and password
issued by the CA, then upload related certificate(s).
Step 3 When all settings are complete, move the camera to the protected LAN by connecting it to an 802.1x
enabled switch. The devices will then start the authentication automatically.