RGS-9244GP Series User Manual
ORing Industrial Networking Corp.
127
successfully authenticated on a port, the whole port is opened for
network traffic. This allows other clients connected to the port (for
instance through a hub) to piggy-back on the successfully
authenticated client and get network access even though they are
not authenticated individually. To overcome this security breach,
use the Multi 802.1X variant.
Multi 802.1X is not yet an IEEE standard, but features many of the
same characteristics as port-based 802.1X. In Multi 802.1X, one
or more supplicants can be authenticated on the same port at the
same time. Each supplicant is authenticated individually and
secured in the MAC table using the Port Security module.
In Multi 802.1X it is not possible to use the multicast BPDU MAC
address as the destination MAC address for EAPOL frames sent
from the switch to the supplicant, since that would cause all
supplicants attached to the port to reply to requests sent from the
switch. Instead, the switch uses the supplicant's MAC address,
which is obtained from the first EAPOL Start or EAPOL Response
Identity frame sent by the supplicant. An exception to this is when
no supplicants are attached. In this case, the switch sends EAPOL
Request Identity frames using the BPDU multicast MAC address
as destination - to wake up any supplicants that might be on the
port.
The maximum number of supplicants that can be attached to a port
can be limited using the Port Security Limit Control functionality.
MAC-based Auth.
Unlike port-based 802.1X, MAC-based authentication is not a
standard, but merely a best-practices method adopted by the
industry. In MAC-based authentication, users are called clients,
and the switch acts as the supplicant on behalf of clients. The initial
frame (any kind of frame) sent by a client is snooped by the switch,
which in turn uses the client's MAC address as both username and
password in the subsequent EAP exchange with the RADIUS
server. The 6-byte MAC address is converted to a string in the
following form "xx-xx-xx-xx-xx-xx", that is, a dash (-) is used as
separator between the lower-cased hexadecimal digits. The switch
only supports the MD5-Challenge authentication method, so the
