SMC Networks 10/100 manual 101

CONFIGURING 802.1X PORT AUTHENTICATION

The IEEE 802.1x (dot1x) standard defines a port-based access control procedure that prevents unauthorized access to a network by requiring users to first enter a user ID and password for authentication. Access to all switch ports in a network can be centrally controlled from a server, which means that authorized users can use a single user ID and password for authentication from any point within the network.

This switch uses the Extensible Authentication Protocol over LAN (EAPOL) with MD5 authentication to exchange authentication protocol messages with the client, and a remote login authentication server (i.e., RADIUS) to verify user identity and access rights. When a client (i.e., Supplicant) connects to a switch port, the switch (i.e., Authenticator) responds with an identity request. The client provides its identity to the switch, which it forwards to the authentication server. The authentication server verifies the client identity and sends this information back to the switch. The switch then issues an MD5 access challenge to the client, and the client returns an MD5 response to the switch based on its user ID and password. If authentication is successful, the switch allows the client to access the network. Otherwise, network access is denied and the port remains blocked.

The operation of dot1x on the switch requires the following:

•The switch must have an IP address assigned.

•RADIUS authentication must be enabled on the switch and the IP address of the RADIUS server specified.

•Each switch port that will be used must be set to dot1x “Auto” mode.

•Each client that needs to be authenticated must have dot1x client software installed and properly configured.

2-101