Asante Technologies 35160 user manual

Page 51

Note: The IC35160 802.1X implementation supports following clients:

Windows XP (Microsoft)

Windows 2000 + SP4 (Microsoft)

The IC35160 802.1X implementation supports following RADIUS servers:

Internet Authentication Service (Microsoft)

The IEEE 802.1X Supplicant (or client) is the network access device requesting LAN services. The Authenticator is the network access point that has authentication enabled, and can be a wireless access point or LAN switch ports. The Authentication server performs the authentication, permitting or denying access to the network based on the client’s user name and password. The 802.1X standard specifies a Remote Authentication Dial-in User Service (RADIUS) server that supports the following:

•RFC 2284 PPP Extensible Authentication Protocol (EAP)

•RFC 2865 that Remote Authentication Dial-In User Service (RADIUS)

•RFC 2869 RADIUS Extensions

Extensible Authentication Protocol (EAP) is the protocol that is used between the client and the authenticator. The 802.1X standard specifies encapsulation methods for transmitting EAP messages. Protocol Access Entity (PAE) is the 802.1X logical component of the client and authenticator that exchange EAP messages.

Since 802.1X is a perimeter security technology, network administrators should continue to deploy existing security policies to control network traffic. Port-based access control will deny unauthorized network access, but it will not control network traffic from authorized users. This may be a concern for network administrators that want to secure network areas with the use of existing methods including VLANs, ACLs or MAC filtering where it is required.

Most 802.1X client implementations and some authenticator implementations use reserved group MAC address to communicate. MAC Bridges that are aware of such reserved group addresses will not propagate the EAPOL packets sent to such addresses. In these cases, the client will always be unauthorized because the switch cannot receive EAP responses from it.

The switch port through which the authenticator (the IC35160) communicates with the RADIUS server should be set to “Force Authenticated” or “No 802.1X”. Otherwise the authenticator cannot get a RADIUS response and all clients will be unauthorized.

From the Security Menu, type x to access the 802.1X Configuration Menu.

51

Image 51

Contents IntraCore 35160 Series Quick Start Guide IntraCore 35160 Series Layer 2 Gigabit Switches User’s ManualTable of Contents Page Introduction FeaturesSwitchCore CXE2010 Package ContentsLEDs 2 IC35160-G 1 IC35160-TFront and Back Panel Descriptions Management and ConfigurationConsole Interface Web-Based InterfaceSnmp Management Recommended Installation Tools Hardware Installation and SetupInstallation Overview Safety OverviewCooling and Airflow Installation into an Equipment RackPower Requirements Environmental RequirementsGbic Interfaces Installing a GbicGbic Care and Handling Installing the Optional Emergency Power SupplyConnecting Power Removing a Gbic1 10/100/1000BaseT Ports Cabling Procedures Connecting to the NetworkSetup Gigabit Ethernet Ports Cabling ProceduresConnecting to a Console Connecting Via Telnet Connecting Via the Web BrowserIP Assignment Changing the PasswordSimple Network Management Protocol Snmp Exiting a Submenu ConfigurationAccessing a Submenu LoggingGeneral Information Configuration MenuChanging System Administration Info Administration ConfigurationSystem IP Configuration Port ConfigurationChanging System IP Information Page Enabling or Disabling a Port Advanced Port ConfigurationEnabling or Disabling 802.3x Flow Control Setting Port Class of ServiceSetting Port Default Priority Setting Port Maximum Packet LengthGlobal Port Configuration Unicast Forwarding Database ConfigurationDisplaying the Forwarding Database Searching for a MAC Address Setting the MAC Address Age-Out TimeSecurity Management Vlan ManagementProtocol Configuration Snmp ConfigurationChanging Community Strings Adding or Updating a Trap Receiver Enabling Authentication TrapsDeleting a Trap Receiver Spanning Tree Protocol STP ConfigurationSpanning Tree Port Configuration Setting Port Priority and Path CostEnabling and Disabling STP Trunk Group Configuration QoS Priority Queue Management Defining the Priority ListAssigning Packets to Priority Queues Example User Interface Configuration Setting Console UI Time-out PeriodSetting SSH/Telnet UI Time-out Change Password Adding or Deleting an Access HostEnabling or Disabling SSH and Telnet Access Control System UtilitiesEnabling or Disabling the Web Server Port Mirroring Enabling or Disabling System Port MirroringAdding or Deleting a Monitor Port System Reset Resetting the SwitchSystem Clock System Log Scheduling a System ResetClearing the System Log Bootstrap ConfigurationTftp File Transfers Ping Utility StatisticsAdvanced Management Snmp and Rmon ManagementRmon Management Viewing a List of Duplicated IP Addresses Duplicated IP Detection and TrapEnabling and Disabling Duplicated IP Detection Enabling and Disabling Duplicated IP TrapEnabling and Disabling Station Movement Trap Configuring Port SecurityConfiguring Port Lock and Intruder Lock Configuring Port New Node Detection TrapResetting Security to Defaults Port-based Network Access ControlConfiguring Security Level 2 or Level Setting the Intruder TrapPage Name Description Port Control SettingsSetting Timers Setting Radius Parameters Radius Server IPServer Port Vlan Specifications for the IntraCore 35160 Series Other Vlan Features of the switchVlan Management Creating a Vlan Configuring Static Vlan GroupsAdvanced Static Vlan Configuration Adding and Deleting VLANs from the Port Configuring Vlan Port AttributesSetting the Port Vlan ID Configuring Port Receive Frame TypeDisplaying a Summary of Vlan Groups Setting Port TypeMulticast Addresses Resetting Vlan Configuration to DefaultsIP Multicast Traffic Management Displaying a Vlan Port SummaryConfiguring IP Multicast Traffic Management Igmp SnoopingEnabling and Disabling Igmp Snooping Displaying a Summary of Group Addresses Advanced Igmp ConfigurationRemoving a Multicast Group Address IP Multicast Forwarding Database ConfigurationAdding Ports to the Selected Address Inserting a Multicast Group AddressWeb-Based Management Accessing with a Web BrowserFront Panel Button Genl Info General Information ButtonManagement Buttons Port Config Port Configuration Button Span Tree Spanning Tree Button Addr Address Table Button Snmp ButtonVlan Configuration Vlan ButtonVlan Group Create Acceptable Frame Type Port ConfigurationSet Port Type Port Vlan ID PvidTag/Untag Port Egress Type Trunking ButtonSecurity Button Port Ingress FilteringPage Snmp Management Snmp Management OperationsSnmp Protocol Community Name and Security MIB TreeName Space Path MIB Groups Supported Vlan ID and Tagged Frames Switching ConceptsVLANs Port-Based VLANsSpanning Tree Parameters Spanning Tree ProtocolPort Vlan ID How It WorksSpanning Tree Port Configuration Full Duplex, Flow Control, and Auto-negotiationFull Duplex Auto-Negotiation Flow ControlProblem Possible Solutions Appendix A. TroubleshootingAppendix B. Features and Specifications SpecificationsPhysical Characteristics Technical Support and Warranty Environmental RangeStandards Compliance Appendix C. FCC Compliance and Warranty Statements FCC Compliance Statement Important Safety InstructionsIntraCare Warranty Statement Page Appendix D. Console Port Pin Outs Pin Number Signal NameAppendix E. Online Warranty Registration Loading Software Locally Appendix F. BootP ConfigurationBootstrap Configuration Image BanksLoading Software Remotely BOOTP-TFTP