802.1x and RADIUS server authentication
U
SER
G
UIDE
136
802.1
X AND
RADIUS
SERVER AUTHENTICATION
You can enable the 802.1x authentication protocol on each Ethernet port. The authentication
process is done by the RADIUS Server using one of these protocols:
PEAP-MSCHAv2
TTLS-CHAP
TTLS-PAP
TTLS-EAPMD5
TTLS-EAP-MSCHAPv2
Once enabled, only the terminals that will successfully authenticate will send and receive packets on
the port to which are linked.
To activate the authentication service, you need first to enable it on the desired port and then to
configure it. This is done using:
You can configure the protocol on each port using:
set eth1 dot1x
set eth2 dot1x
....
set eth8 dot1x
It is possible to activate the packets exchange only for the MAC address that requests the
authentication or you can activate it on the whole port. In this case, the incoming packet is not
blocked even if the MAC address is different from the one that requested the authentication.
For example with:
set eth1 dot1x enable single-mac
set eth2 dot1x enable whole-port
on the
eth1
port will transit only the packets coming from the MAC address that has done the
authentication, while on the
eth2
port, after the authentication, all packets can be transmitted.
The service will be active at the next bootstrap, but if you want to enable it immediately, use:
set ethX dot1x on
To be sure that everything runs properly, the parameters that gives access to the RADIUS Server
(that will authenticate for the Imola router) must already be configured. To do so, you can use:
set dot1x authhost <ipaddress>
set dot1x authsecret <string>
to gain access to the RADIUS Server that makes the authentication of the clients that want to access
the network, you have to configure the IP address and the password:
set dot1x accthost <ipaddress>
set dot1x acctsecret <string>
to set the IP address and the password of the accounting server, use:
set dot1x source <ipaddress>
