CTC Union GSW-3208M2 страница 55 Скачать руководство пользователя

Страница: 55 / 145

Chapter 4

Web Configuration & Operation

the Guest VLAN is disabled on all ports.

Guest VLAN ID:

This VLAN ID is functional only when Guest VLAN is enabled. This is the value that a port’s Port VLAN ID is

set to if a port is moved into the Guest VLAN. The range is 1

4095.

Max. Reauth. Count:

The maximum number of times the switch transmits an EAPOL Request Identity frame without

receiving a response before adding a port to the Guest VLAN. The value can only be changed when the Guest VLAN
option is globally enabled. The range is 1

255.

Allow Guest VLAN if EAPOL Seen:

The switch remembers if an EAPOL frame has been received on the port for the life-

time of the port. Once the switch considers whether to enter the Guest VLAN, it will first check if this option is enabled or
disabled. If disabled (unchecked; default), the switch will only enter the Guest VLAN if an EAPOL frame has not been
received on the port for the life-time of the port. If enabled (checked), the switch will consider entering the Guest VLAN
even if an EAPOL frame has been received on the port for the life-time of the port. The value can only be changed if the
Guest VLAN option is globally enabled.

Port Configuration

Port:

Port number. “Port *” rules apply to all ports.

Admin State:

Select the authentication mode on a port. This setting works only when NAS is globally enabled. The

following modes are available:

Force Authorized:

In this mode, the switch will send one EAPOL Success frame when the port link comes up, and any

client on the port will be allowed network access without authentication.

Force Unauthorized:

In this mode, the switch will send one EAPOL Failure frame when the port link comes up, and

any client on the port will be disallowed network access.

Port-Based 802.1X:

This mode requires a dot1x-aware client to be authorized by the authentication server. Clients

that are not dot1x-aware will be denied access.

Single 802.1X:

In Single 802.1X, at most one supplicant can get authenticated on the port at a time. Normal EAPOL

frames are used in the communication between the supplicant and the switch. If more than one supplicant is
connected to a port, the one that comes first when the port's link comes up will be the first one considered. If that
supplicant doesn't provide valid credentials within a certain amount of time, another supplicant will get a chance.
Once a supplicant is successfully authenticated, only that supplicant will be allowed access. This is the most secure of
all the supported modes. In this mode, the “Port Security” module is used to secure a supplicant's MAC address once
successfully authenticated.

Multi 802.1X:

In Multi 802.1X, one or more supplicants can get authenticated on the same port at the same time.

Each supplicant is authenticated individually and secured in the MAC table using the “Port Security” module.

MAC-based Auth.:

Unlike port-based 802.1X, MAC-based authentication do not transmit or receive EAPOL frames.

In MAC-based authentication, the switch acts as the supplicant on behalf of clients. The initial frame (any kind of
frame) sent by a client is snooped by the switch, which in turn uses the client's MAC address as both username and
password in the subsequent EAP exchange with the RADIUS server. The 6-byte MAC address is converted to a string
on the following form "xx-xx-xx-xx-xx-xx", that is, a dash (-) is used as separator between the lower-cased
hexadecimal digits. The switch only supports the MD5-Challenge authentication method, so the RADIUS server must
be configured accordingly.

RADIUS-Assigned QoS Enabled:

Select the checkbox to enable RADIUS-Assigned QoS on a port.

Radius-Assigned VLAN Enabled:

Select the checkbox to enable RADIUS-Assigned VLAN on a port.

Guest VLAN Enabled:

Select the checkbox to enable Guest VLAN on a port.

Port State:

Display the current state of the port from 802.1X authentication point of view. The possible states are as

follows: