iES28TG/iES28GF User Manual
153
iS5 Communications Inc.
Single 802.1X
In port-based 802.1X authentication, once a supplicant is successfully
authenticated on a port, the whole port is opened for network traffic.
This allows other clients connected to the port (for instance through a
hub) to piggy-back on the successfully authenticated client and get
network access even though they are not authenticated individually. To
overcome this security breach, use the Single 802.1X variant.
Single 802.1X is not yet an IEEE standard, but features many of the same
characteristics as port-based 802.1X. In Single 802.1X, at most one
supplicant can get authenticated on the port at a time. Normal EAPOL frames
are used in the communications between the supplicant and the switch. If
more than one supplicant are connected to a port, the one that comes
first when the port's link is connected will be the first one considered.
If that supplicant does not provide valid credentials within a certain amount
of time, the chance will be given to another supplicant. Once a supplicant
is successfully authenticated, only that supplicant will be allowed access.
This is the most secure of all the supported modes. In this mode, the Port
Security module is used to secure a supplicant's MAC address once
successfully authenticated.
