D-Link DGS-3224TGR - Switch, Руководство пользователя

Страница: 32 / 160

DGS-3224TGR Gigabit Ethernet Switch User’s Guide
20
If the packet is not tagged with VLAN information, the ingress port will tag the packet with its own PVID as a VID. The
switch then determines if the destination port is a member of the same VLAN (has the same VID) as the ingress port. If it
does not, the packet is dropped. If it has the same VID, the packet is forwarded and the destination port transmits it on its
attached network segment.
This process is referred to as ingress filtering and is used to conserve bandwidth within the switch by dropping packets that
are not on the same VLAN as the ingress port at the point of reception . This eliminates the subsequent processing of
packets that will just be dropped by the destination port.
802.1x Port-Based and MAC-Based Access Control
The IEEE 802.1x standard is a security measure for authorizing and authenticating users to gain access to various wired or
wireless devices on a specified Local Area Network by using a Client and Server based access control model. This is
accomplished by using a RADIUS server to authenticate users trying to access a network by relaying Extensible
Authentication Protocol over LAN (EAPOL) packets between the Client and the Server. The following figure represents a
basic EAPOL packet:
Figure 5- 4. The EAPOL Packet
Utilizing this method, unauthorized devices are restricted from connecting to a LAN through a port to which the user is
connected. EAPOL packets are the only traffic that can be transmitted through the specific port until authorization is
granted. The 802.1x Access Control method holds three roles, each of which are vital to creating and upkeeping a stable
and working Access Control security method.
Figure 5- 5. The three roles of 802.1x
The following section will explain the three roles of Client, Authenticator and Authentication Server in greater detail.