RGS-9244GP Series User Manual
ORing Industrial Networking Corp.
122
supplicant and the authentication server are using, or how many information exchange frames
are needed for a particular method. The switch simply encapsulates the EAP part of the frame
into the relevant type (EAPOL or RADIUS) and forwards it.
When authentication is complete, the RADIUS server sends a special packet containing a
success or failure indication. Besides forwarding the result to the supplicant, the switch uses it
to open up or block traffic on the switch port connected to the supplicant.
Note: in an environment where two backend servers are enabled, the server timeout is
configured to X seconds (using the authentication configuration page), and the first server in
the list is currently down (but not considered dead), if the supplicant retransmits EAPOL Start
frames at a rate faster than X seconds, it will never be authenticated because the switch will
cancel on-going backend authentication server requests whenever it receives a new EAPOL
Start frame from the supplicant. Since the server has not failed (because the X seconds have
not expired), the same server will be contacted when the next backend authentication server
requests from the switch. This scenario will loop forever. Therefore, the server timeout should
be smaller than the supplicant's EAPOL Start frame retransmission rate.
Overview of MAC-Based Authentication
Unlike 802.1X, MAC-based authentication is not a standard, but merely a best-practices
method adopted by the industry. In MAC-based authentication, users are called clients, and the
switch acts as the supplicant on behalf of clients. The initial frame (any kind of frame) sent by
a client is snooped by the switch, which in turn uses the client's MAC address as both username
and password in the subsequent EAP exchange with the RADIUS server. The 6-byte MAC
address is converted to a string in the following form "xx-xx-xx-xx-xx-xx", that is, a dash (-) is
used as separator between the lower-cased hexadecimal digits. The switch only supports the
MD5-Challenge authentication method, so the RADIUS server must be configured accordingly.
When authentication is complete, the RADIUS server sends a success or failure indication,
which in turn causes the switch to open up or block traffic for that particular client, using static
entries into the MAC Table. Only then will frames from the client be forwarded on the switch.
There are no EAPOL frames involved in this authentication, and therefore, MAC-based
authentication has nothing to do with the 802.1X standard.
The advantage of MAC-based authentication over 802.1X is that several clients can be
connected to the same port (e.g. through a 3rd party switch or a hub) and still require individual
