SignaMax 065-7840, Руководство пользователя

Страница: 117 / 228

Signamax 065-7840 24-Port 10/100/1000BaseT/TX Managed Switch
107
3-15. 802.1x Configuration
802.1x port-based network access control provides a method to restrict users
to accessing network resources via authenticating the user’s information. This
restricts users from gaining access to the network resources through an 802.1x-
enabled port without authentication. If a user wishes to administer the network
through a port under 802.1x control, he or she must first input his or her account
name for authentication and wait to receive authorization before sending or
receiving any packets from an 802.1x-enabled port.
Before the devices or end stations can access the network resources through
the ports under 802.1x control, the devices or end stations connected to a controlled
port send the authentication request to the authenticator; the authenticator passes
the request to the authentication server to authenticate and verify, and the server
tells the authenticator if the request has been granted authorization for the ports.
According to IEEE 802.1x, there are three components implemented. They
are Authenticator, Supplicant, and Authentication server, as shown in Fig. 3-49.
Supplicant:
An entity being authenticated by an authenticator. It is used to
communicate with the Authenticator PAE (Port Access Entity) by
exchanging the authentication message when the Authenticator PAE
issues a request to it.
Authenticator:
An entity that facilitates the authentication of the supplicant entity. It
controls the state of the port, authorized or unauthorized, according to
the result of the authentication message exchanged between it and a
supplicant PAE. The authenticator may request the supplicant to re-
authenticate itself at a configured time period. Once re-authentication of
the supplicant has started, the controlled port remains in the authorized
state until re-authentication fails.
A port acting as an authenticator is thought to be two logical ports, a
controlled port and an uncontrolled port. A controlled port can only pass
the packets when the authenticator PAE is authorized, and otherwise, an
uncontrolled port will unconditionally pass the packets with the PAE
group MAC address, which has the value of 01-80-c2-00-00-03 and will
not be forwarded by a MAC bridge, at any time.
Authentication server:
A device that provides authentication service, through EAP, to an
authenticator by using authentication credentials supplied by the
supplicant to determine if the supplicant is authorized to access the
network resource.