User’s Manual
262
successfully authenticated.
Multi 802.1X
Multi 802.1X is - like Single 802.1X - not an IEEE standard, but a variant that
features many of the same characteristics. In Multi 802.1X, one or more
supplicants can get authenticated on the same port at the same time. Each
supplicant is authenticated individually and secured in the MAC table using the
Port Security module.
In Multi 802.1X it is not possible to use the multicast BPDU MAC address as
destination MAC address for EAPOL frames sent from the switch towards the
supplicant, since that would cause all supplicants attached to the port to reply to
requests sent from the switch. Instead, the switch uses the supplicant's MAC
address, which is obtained from the first EAPOL Start or EAPOL Response
Identity frame sent by the supplicant. An exception to this is when no supplicants
are attached. In this case, the switch sends EAPOL Request Identity frames
using the BPDU multicast MAC address as destination - to wake up any
supplicants that might be on the port.
The maximum number of supplicants that can be attached to a port can be
limited using the Port Security Limit Control functionality.
MAC-based Auth.
Unlike port-based 802.1X, MAC-based authentication is not a standard, but
merely a best-practices method adopted by the industry. In MAC-based
authentication, users are called clients, and the switch acts as the supplicant on
behalf of clients. The initial frame (any kind of frame) sent by a client is snooped
by the switch, which in turn uses the client's MAC address as both username and
password in the subsequent EAP exchange with the RADIUS server. The 6-byte
MAC address is converted to a string on the following form "xx-xx-xx-xx-xx-xx",
that is, a dash (-) is used as separator between the lower-cased hexadecimal
digits. The switch only supports the MD5-Challenge authentication method, so
the RADIUS server must be configured accordingly.
When authentication is complete, the RADIUS server sends a success or failure
indication, which in turn causes the switch to open up or block traffic for that
particular client, using the Port Security module. Only then will frames from the
client be forwarded on the switch. There are no EAPOL frames involved in this
authentication, and therefore, MAC-based Authentication has nothing to do with
the 802.1X standard.
The advantage of MAC-based authentication over port-based 802.1X is that
Содержание IGS-10020
Страница 1: ...User s Manual...
Страница 31: ...User s Manual 31 IGS 10020PT IGS 10020PT Dimensions W x D x H 72 x 107 x 152mm...
Страница 32: ...User s Manual 32 IGS 10020HPT IGS 10020HPT Dimensions W x D x H 72 x 107 x 152mm...
Страница 33: ...User s Manual 33 IGS 10080MFT IGS 10080MFT Dimensions W x D x H 72 x 107x 152mm...
Страница 34: ...User s Manual 34 IGS 12040MT IGS 12040MT Dimensions W x D x H 72 x 107 x 152mm...
Страница 35: ...User s Manual 35 IGS 20040MT IGS 20040MT Dimensions W x D x H 72 x 107 x 152mm...
Страница 36: ...User s Manual 36 IGS 20160HPT IGS 20160HPT Dimensions W x D x H 84 x 107 x 152mm...
Страница 46: ...User s Manual 46 Figure 2 16 IGS 10080MFT Upper Panel Figure 2 17 IGS 12040MT Upper Panel...
Страница 47: ...User s Manual 47 Figure 2 18 IGS 20040MT Upper Panel Figure 2 19 IGS 20160HPT Upper Panel...
Страница 181: ...User s Manual 181 Figure 4 8 2 Multicast Flooding Figure 4 8 3 IGMP Snooping Multicast Stream Control...
