Dell 6.2 Chapte r 14

DellPowerConnect W- Series ArubaOS 6.2 | User Guide 802.1XAuthentication |192
Chapte r 14
802.1X Authentication
802.1X is an Instit ute of Electrical and Electronics Engineers (IEEE) standard that provides an authenticatio n
frameworkfor WLANs. 80 2.1x uses the Extensible Authentication Protoco l (EAP) to exchange messages during the
authentication process. The authentication protocols that operate inside the 80 2.1X framework that are suitable for
wireless networks includeE AP-Transport Layer Security (EAP-TLS), Protected EAP (PEAP), and EAP-Tunneled
TLS (EAP-TTLS). These protocols allow the networkto authenticate the client while also allowingt heclient t o
authenticate the network.
This chapter describes the following topics:
l"Understanding802.1X Authentication" on page 192
l"Configuring802.1X Authentication" on page 195
l"SampleConfigurations" on page 204
l"PerformingAdvanced Configuration Options for 80 2.1X" on page 220
Otherty pes of authentication not discussed in this secti on can be found in the following sections of this guide:
lCaptive portal authentication: "Configuring Captive Portal Authentication Profiles" on page 24 6
lVPN authentication: "Planning a VPN Configuration" on page 271
lMAC authentication: "ConfiguringMAC-Based A uthentication" on page 189
lStateful80 2.1x, stateful NTLM, and WISPr authentication: "Statefuland WISPr A uthentication" on page 221
Understanding 8 02.1X Authentication
802.1x authentication consists of t hreecomponents:
lThe supplicant , or client,i s the device attempting to gain access to the network. You can configuret heD elluser-
centric networkt o support8 02.1x authentication for wiredusers as well as wireless users.
lThe authenticator is the gatekeepert o the networkand permits or denies access to the supplicants.
lThe Dell controller acts as the authenticator, relayingi nformationbetween the authentication server and
supplicant.The EA P type must be consistent between the authentication server and supplicant and is
transparentto the controller.
The authentication server provides a database of information required forauthenticat ion and informs the
authenticator to deny orpermit access to the supplicant.
The 802.1X authentication server is ty picallyan EAP-compliant Remote Access Dial-In User Service (RADIUS)
serverwhich c an authenticate either users (throughpasswords or certi ficates) or the client computer.
An exampleof an 802.1X authentication server is t he Internet Authentication Service (IAS) in Windows (see
http://technet.microsoft.com/en-us/library/ cc759077(WS.10).aspx).
Dell user-centricnetworks, you can terminate the 802.1x authentication on the controller. The controllerpasses
userauthenticati ont o its internaldatabase or to a “backend” non-802.1X server. This feature,also called AAA
FastConnect , is useful for deploymentsw herean 80 2.1X EAP-compliant RAD IUS server is not available or
requiredfor authentication.