Supermicro SuperBlade SBM-GEM-X2C, Руководство пользователя

Страница: 79 / 334

25
Chapter 6: 1-Gb Ethernet Switch Firmware
6-11 IEEE 802.1x
IEEE 802.1x is a client-server based access control and authentication protocol that
restricts unauthorized user devices from connecting to the LAN through publicly
accessible ports. This port-based access control is accomplished by using a RADIUS
server that is connected to a gigabit switch management port to authenticate client
users trying to access a network through the switch. The gigabit switch will relay
Extensible Authentication Protocol over LAN (EAPoL) packets between the user client
and the RADIUS server. The 802.1x protocol consists of three components: client,
authenticator and authentication server.
The Authentication Server is a remote device that runs the RADIUS server program
(Windows 2000/2003 IAS™, freeRADIUS™ from open source). The role of the
Authentication Server is to certify the identity of a client attempting to access the
network. By exchanging secure information between the RADIUS server and the client
through EAPoL packets, the Authentication Server will inform the switch whether or not
the client is granted access to the LAN through the connected port.
The client is a workstation that wishes to access the network through a connected
switch port. All workstations have to run a program (supplicant) that is compliant with the
802.1x protocol. Microsoft Windows XP™ and Vista™ should have this. A user can also
install another third party package, such as Odyssey® from Funk Software®.
When the G
LOBAL
R
ADIUS
S
ETTING
and S
ET
S
TATUS
of an individual port are enabled,
that port will initially be placed into an unauthorized state. The client will initiate
negotiations by sending an EAPOL
START
packet.
There are several EAP authentication methods available in Microsoft Windows XP, such
as
EAP-MD5 , EAP-TLS and EAP-PEAP . Currently, the gigabit switch only supports
EAP-MD5 for 802.1x authentication.
• PEAP-MS-CHAP v2 uses password-based credentials and requires computer
certificates on the RADIUS servers.
• EAP-TLS uses certificate-based credentials and requires user and computer
certificates on the wire’s client computers and computer certificates on the RADIUS
servers.
• EAP-MD5 (Message Digest 5) Challenge Handshake Authentication Protocol (MD5
CHAP), which uses passwords.
Wiring for 802.1x
The EAPOL packets are handled by a management processor in the switch. The
processor communicates with the outside world through three ports. Two ports (eth0
and eth1) are connected to the CMM module's Ethernet port and the third port (eth2) is
connected to all 24 switching ports. Only one port is enabled at any time. The regular
configuration setup switch is managed through the CMM Ethernet port. Thus, for regular
deployment, the RADIUS server should be located where it can be reached from the
CMM Ethernet port.