Enterasys Networks DFE-Gold Series Configuring 802.1X Authentication

Configuring 802.1X Authentication
25-2 Authentication Configuration
•Localusercredentials—usedforlocalauthenticationandauthorizationofCLIandWebView
managementsessions.Fordetails,referto“SettingUserAccountsandPasswords”on
page 2‐15and“SettingtheAuthenticationLoginMethod”onpage 25‐50.
•RemoteAAAservice—usedforremoteauthentication,authorization,andaccountingofCLI
andWebViewmanagementsessions,aswellasallnetworkaccesssessionsprovisionedby
wayof802.1x,PWA,orMACAuthentication.Fordetails,referto“SettingtheAuthentication
LoginMethod”onpage 25‐50and“Configuring802.1XAuthentication”onpage 25‐2.
• SupportforRADUIS,RFC3580,andTACACS+canbefoundinthefollowingsections:
“ConfiguringRADIUS”onpage 25‐53,“ConfiguringRFC3580”onpage 25‐60,and
“ConfiguringTACACS+”onpage 25‐63
Configuring 802.1X Authentication
About Multi-User Authentication
EnterasysNetworks’enhancedversionoftheIEEE802.1X‐2001specificationdecreasessecurity
vulnerabilitiesinherentwiththestandardimplementation,andallowsmultipledevicesandusers,
alsoknownas“supplicants,”tobeauthenticatedonasingleport.Theenhancedstandardclearly
distinguisheseachnetworkaccessportfromitsaccess“entities,”whichmaintainauthentication
instructionsassociatedwitheachuniquepotentialsupplicant.
802.1Xenhancementsarebackwards‐compatiblewithexisting802.1Xsupplicantsand
configurations,andaredesignedtoseamlesslyintegrateintoEnterasys’per‐userpolicy
managementsystem;allowingmuchmoregranularcontroloveruserauthorization.
TheEnterasysmulti‐user802.1Ximplementationincludesthefollowingcomponents:
•AMulti‐ModeEnabledEnterasysMatrixSystem—onlywhenasystemissettooperatein
multipleauthenticationmode(asdescribedin“ConfiguringMultipleAuthentication”on
page 27‐1)cantheenhanced802.1Xfeaturebeused.Thesystemʹsportsintendedfornetwork
accesstoauthenticateandauthorizesupplicantswillbeallowedtosimultaneouslyutilize
morethanoneaccessentity.
• AccessEntities—responsibleformaintainingstate,counters,andstatisticsforanindividual
supplicant.Anaccessentityisactivatedfromapoolofconfiguredaccessentitieswhena
potentialsupplicantonaportneedstobeauthenticated.Itbecomesdeactivatedwhenthe
supplicantlogsoff,cannotbeauthenticated,ortheEnterasysMatrixdevicedeterminesthat
thesupplicantorassociatedpolicysettingsarenolongervalid.
• Supplicants—devicesorusersthatdesireaccesstothenetwork,suchasworkstations,
printers,PDAs,orhard‐wiredorwirelessphones.Thesewillbeidentifiedbythesystemusing
acombinationofconnectionport,MACaddresses,andallocatedaccessentityindex.Oncea
supplicantissuccessfullyauthenticated,thesystemisresponsibleforenforcingthedegreeto
whichthesupplicantwillbeauthorizedtoaccessthenetwork,usinginformationsenttoitby
theauthenticationserver.
• AuthenticationServer—typicallyaRADIUSauthority,wheretheEnterasysMatrixsystemand
serverhavemutually‐configuredknowledgeofoneanother.
Purpose
Toreviewandconfigure802.1XauthenticationforoneormoreportsusingEAPOL(Extensible
AuthenticationProtocol).802.1Xcontrolsnetworkaccessbyenforcinguserauthorizationon