Dell N1100-ON, Справочное руководство

Страница: 843 / 2332

Security Commands
843
MAC Authentication Bypass (MAB) provides 802.1x unaware clients
controlled access to the network using the devices’ MAC address as an
identifier. This requires that the known and allowable MAC address and
corresponding access rights be prepopulated in the authentication server.
MAB only works when the port control mode of the port is MAC-based.
Port access by MAB clients is allowed via local authentication if the user
database has corresponding entries added for the MAB clients with user name
and password attributes set to the MAC address of MAB clients. Alternatively,
a RADIUS authentication server can be configured with the MAC addresses
of the MAB clients. In this configuration, the switch uses EAP-MD5
authentication to communicate with the authentication server. No other
authentication or privacy protocol is supported for server side authentication.
Guest VLAN
The Guest VLAN feature allows a Dell EMC Networking switch to provide a
distinguished service to unauthenticated network devices (not rogue devices
that fail authentication). This feature provides a mechanism to allow network
devices to have network access to reach an external network while restricting
their ability to access the internal LAN.
When a client that does not support 802.1x is connected to an unauthorized
port that is 802.1x-enabled, the client does not respond to the 802.1x requests
from the switch. The port remains in the unauthorized state and the client is
not granted access to the network. If a guest VLAN is configured for that port,
then the port is placed in the configured guest VLAN, and the port is moved
to the authorized state, allowing network access to the client over the guest
VLAN.
Unauthenticated VLAN
The Unauthenticated VLAN feature allows a Dell EMC Networking switch to
provide a distinguished service to unauthorized network devices that attempt
and fail authentication. This feature provides a mechanism to allow network
devices to have network access to an external network while restricting their
ability to access the internal LAN.
When a client network device that supports 802.1x is connected to an
unauthorized port that is 802.1x enabled with no unauthenticated VLAN
configured and the client attempts and fails to authenticate, the port remains