Chapter 4. Web Configuration & Operation
234
CHAPTER 4
WEB OPERATION & CONFIGURATION
Guest VLAN ID:
This VLAN ID is functional only when Guest VLAN is enabled. This is the value that a port’s Port VLAN
ID is set to if a port is moved into the Guest VLAN. The range is 1–4095.
Max. Reauth. Count:
The maximum number of times the switch transmits an EAPOL Request Identity frame without
receiving a response before adding a port to the Guest VLAN. The value can only be changed when the Guest VLAN
option is globally enabled. The range is 1–255.
Allow Guest VLAN if EAPOL Seen:
The switch remembers if an EAPOL frame has been received on the port for the life-
time of the port. Once the switch considers whether to enter the Guest VLAN, it will first check if this option is enabled
or disabled. If disabled (unchecked; default), the switch will only enter the Guest VLAN if an EAPOL frame has not been
received on the port for the life-time of the port. If enabled (checked), the switch will consider entering the Guest
VLAN even if an EAPOL frame has been received on the port for the life-time of the port. The value can only be
changed if the Guest VLAN option is globally enabled.
Port Configuration
Port:
The port number. “Port *” rules apply to all ports.
Admin State:
Select the authentication mode on a port. This setting works only when NAS is globally enabled. The
following modes are available:
Force Authorized:
In this mode, the switch will send one EAPOL Success frame when the port link comes up, and
any client on the port will be allowed network access without authentication.
Force Unauthorized:
In this mode, the switch will send one EAPOL Failure frame when the port link comes up,
and any client on the port will be disallowed network access.
Port-Based 802.1X:
This mode requires a dot1x-aware client to be authorized by the authentication server.
Clients that are not dot1x-aware will be denied access.
Single 802.1X:
In Single 802.1X, at most one supplicant can get authenticated on the port at a time. Normal
EAPOL frames are used in the communication between the supplicant and the switch. If more than one
supplicant is connected to a port, the one that comes first when the port's link comes up will be the first one
considered. If that supplicant doesn't provide valid credentials within a certain amount of time, another
supplicant will get a chance. Once a supplicant is successfully authenticated, only that supplicant will be allowed
access. This is the most secure of all the supported modes. In this mode, the “Port Security” module is used to
secure a supplicant's MAC address once successfully authenticated.
Multi 802.1X:
In Multi 802.1X, one or more supplicants can get authenticated on the same port at the same time.
Each supplicant is authenticated individually and secured in the MAC table using the “Port Security” module.
MAC-based Auth.:
Unlike port-based 802.1X, MAC-based authentication do not transmit or receive EAPOL
frames. In MAC-based authentication, the switch acts as the supplicant on behalf of clients. The initial frame (any
kind of frame) sent by a client is snooped by the switch, which in turn uses the client's MAC address as both
username and password in the subsequent EAP exchange with the RADIUS server. The 6-byte MAC address is
converted to a string on the following form "xx-xx-xx-xx-xx-xx", that is, a dash (-) is used as separator between the
lower-cased hexadecimal digits. The switch only supports the MD5-Challenge authentication method, so the
RADIUS server must be configured accordingly.
RADIUS-Assigned QoS Enabled:
Select the checkbox to enable RADIUS-Assigned QoS on a port.
Radius-Assigned VLAN Enabled:
Select the checkbox to enable RADIUS-Assigned VLAN on a port.
Guest VLAN Enabled:
Select the checkbox to enable Guest VLAN on a port.
Port State:
Display the current state of the port from 802.1X authentication point of view. The possible states are as
follows:
Содержание MSW-4424C Series
Страница 1: ...1 MSW 4424C MSW 4424CS L2 Gigabit Carrier Ethernet Switch ...
Страница 382: ......
