4

802.1X Network Access Control

Port-based network access control allows the operation of a system’s port(s) to be controlled to ensure that access to its services is permitted only by systems that are authorized to do so.

Port Access Control provides a means of preventing unauthorized access by supplicants or users to the services offered by a System. Control over the access to a switch and the LAN to which it is connected can be desirable in order to restrict access to publicly accessible bridge ports or departmental LANs.

The Unified Switch achieves access control by enforcing authentication of supplicants that are attached to an authenticator’s controlled ports. The result of the authentication process determines whether the supplicant is authorized to access services on that controlled port.

A PAE (Port Access Entity) can adopt one of two roles within an access control interaction:

•Authenticator – Port that enforces authentication before allowing access to services avail- able via that Port.

•Supplicant – Port that attempts to access services offered by the Authenticator.

Additionally, there exists a third role:

•Authentication server – Server that performs the authentication function necessary to check the credentials of the supplicant on behalf of the Authenticator.

Completion of an authentication exchange requires all three roles. The Unified Switch supports the authenticator role only, in which the PAE is responsible for communicating with the supplicant. The authenticator PAE is also responsible for submitting information received from the supplicant to the authentication server in order for the credentials to be checked, which determines the authorization state of the port. Depending on the outcome of the authentication process, the authenticator PAE then controls the authorized/unauthorized state of the controlled Port.

Authentication can be handled locally or via an external authentication server. Two are: Remote Authentication Dial-In User Service (RADIUS) or Terminal Access Controller Access Control System (TACACS+). The Unified Switch currently supports RADIUS for 802.1X.

RADIUS supports an accounting function to maintain data on service usages. Under RFC 2866, an extension was added to the RADIUS protocol giving the client the ability to deliver accounting information about a user to an accounting server. Exchanges to the accounting server follow similar guidelines as that of an authentication server but the flows are much

37

Page 36 Page 38
Page 37
Image 37
D-Link DWS-3000 manual 802.1X Network Access Control
Page 36 Page 38

DWS-3000 specifications

The D-Link DWS-3000 is an advanced cloud-ready wireless switch designed to meet the increasing demands of modern networks. As organizations transition to more mobile and connected environments, the need for robust and scalable networking solutions becomes paramount. The DWS-3000 addresses this need with its range of features, technologies, and specifications tailored for seamless network management.

One of the standout features of the DWS-3000 is its support for centralized management, allowing IT administrators to oversee multiple access points from a single interface. This simplifies the process of provisioning, monitoring, and troubleshooting network devices, ensuring optimal performance and minimizing downtime. The switch's intuitive web interface and support for D-View, D-Link's network management software, enable effective control over network operations.

The DWS-3000 is equipped with advanced security protocols to safeguard sensitive data within the network. It supports WPA3 encryption, which enhances security compared to its predecessor, WPA2. Additionally, features like MAC address filtering, 802.1X authentication, and rogue AP detection provide comprehensive protection against unauthorized access.

In terms of performance, the DWS-3000 leverages high-capacity hardware to support PoE (Power over Ethernet) technology, enabling power delivery to compatible devices without the need for additional cabling. This feature is particularly beneficial for deployment scenarios where cabling infrastructure is limited.

Moreover, the DWS-3000 is built with scalability in mind. It can support a vast number of access points, making it suitable for deployments ranging from small businesses to large enterprises. This scalability, combined with features like load balancing and Band Steering, ensures efficient use of available bandwidth, enhancing user experience.

The switch also offers seamless integration with D-Link’s suite of access points, allowing for simplified deployments in various environments, whether indoor or outdoor. The capabilities of the DWS-3000 extend into a comprehensive analytics engine, which provides insights into network performance and user behavior, aiding in informed decision-making.

With its blend of advanced features, robust security measures, and scalability, the D-Link DWS-3000 is positioned as a powerful solution for organizations looking to elevate their network infrastructure. It empowers businesses to provide reliable, high-performance wireless connectivity while maintaining security and ease of management in today’s dynamic environment.
Top Page Image Contents