RGPS-92222GCP-NP Series User Manual
ORing Industrial Networking Corp.
120
limited using the Port Security Limit Control functionality.
MAC-based Auth.
Unlike port-based 802.1X, MAC-based authentication is not a standard, but
merely a best-practices method adopted by the industry. In MAC-based
authentication, users are called clients, and the switch acts as the supplicant
on behalf of clients. The initial frame (any kind of frame) sent by a client is
snooped by the switch, which in turn uses the client's MAC address as both
username and password in the subsequent EAP exchange with the RADIUS
server. The 6-byte MAC address is converted to a string in the following form
"xx-xx-xx-xx-xx-xx", that is, a dash (-) is used as separator between the
lower-cased
hexadecimal
digits.
The
switch
only
supports
the
MD5-Challenge authentication method, so the RADIUS server must be
configured accordingly.
When authentication is complete, the RADIUS server sends a success or
failure indication, which in turn causes the switch to open up or block traffic
for that particular client, using the Port Security module. Only then will frames
from the client be forwarded on the switch. There are no EAPOL frames
involved in this authentication, and therefore, MAC-based authentication has
nothing to do with the 802.1X standard.
The advantage of MAC-based authentication over port-based 802.1X is that
several clients can be connected to the same port (e.g. through a 3rd party
switch or a hub) and still require individual authentication, and that the clients
don't need special supplicant software to authenticate. The advantage of
MAC-based authentication over 802.1X-based authentication is that the
clients do not need special supplicant software to authenticate. The
disadvantage is that MAC addresses can be spoofed by malicious users -
equipment whose MAC address is a valid RADIUS user can be used by
anyone. Also, only the MD5-Challenge method is supported. The maximum
number of clients that can be attached to a port can be limited using the Port
Security Limit Control functionality.
Port State
The current state of the port. It can undertake one of the following values:
Globally Disabled
: NAS is globally disabled.
Link Down
: NAS is globally enabled, but there is no link on the port.
Authorized
: the port is in Force Authorized or a single-supplicant mode and
the supplicant is authorized.
Unauthorized:
the port is in Force Unauthorized or a single-supplicant mode
and the supplicant is not successfully authorized by the RADIUS server.
