Extreme Networks ExtremeWare 7.2e, Инструкция по установке и эксплуатации

Страница: 152 / 344

152 ExtremeWare 7.2e Installation and User Guide
Security
Co-existence of Web-Based and 802.1x Authentication
ExtremeWare supports both web-based and 802.1x authentication. Authenticating with 802.1x does not
require any additional commands besides those used for web-based mode.
When a port is configured for Network Login, the port is put in unauthenticated state. It is ready to
perform either type of authentication. Whether to perform web-based or 802.1x depends on the type of
packets being received from the client. Web-based mode uses HTTP, while 802.1x uses EAPOL with an
Ethertype of 0x888e.
This implementation provides a smooth migration path from non-802.1x clients to 802.1x clients. The
advantage of web-based mode is platform-independence. While 802.1x mode is currently supported
natively only on Windows XP clients, any device with an Internet browser can perform web-based
Network Login.
Comparison of Web-Based and 802.1x Authentication
Pros of 802.1x authentication:
• In cases where the 802.1x is natively supported, login and authentication happens transparently.
• Authentication happens at layer 2. Does not involve getting a temporary IP address and subsequent
release of the address to a get a more permanent IP address.
• Allows for periodic, transparent, re-authorization of supplicants.
Cons of 802.1x authentication:
• 802.1x native support is available only on the newer operating systems like Windows XP.
• 802.1x requires an EAP-capable RADIUS server.
• TLS authentication method involves Public Key Infrastructure, which requires more administration.
• TTLS is still a Funk/Certicom IETF draft proposal and not a fully accepted standard, but it is easy to
deploy and administer.
Pros of web-based authentication:
• Works with any operating system with a web browser. There is no need for any client side software.
• Provides easier administration based on username and password.
Cons of web-based authentication:
• Login process involves juggling with IP addresses and has to be done outside the scope of a regular
computer login, therefore it is not tied to Windows login. One has to specifically bring up a login
page and initiate a login.
• Supplicants cannot be re-authenticated transparently. Cannot be re-authenticated from the
authenticator side.
• Does not support more secure methods of authentication.