C
ONFIGURING

THE

S

WITCH

2-130

The IEEE 802.1x (dot1x) standard defines a port-based access
control procedure that prevents unauthorized access to a network
by requiring users to first enter a user ID and password for
authentication. Access to all switch ports in a network can be
centrally controlled from a server, which means that authorized
users can use a single user ID and password for authentication
from any point within the network.
This switch uses the Extensible Authentication Protocol over LAN
(EAPOL) with MD5 authentication to exchange authentication
protocol messages with the client, and a remote login
authentication server (i.e., RADIUS) to verify user identity and
access rights. When a client (i.e., Supplicant) connects to a switch
port, the switch (i.e., Authenticator) responds with an identity
request. The client provides its identity to the switch, which it
forwards to the authentication server. The authentication server
verifies the client identity and sends this information back to the
switch. The switch then issues an MD5 access challenge to the
client, and the client returns an MD5 response to the switch based
on its user ID and password. If authentication is successful, the
switch allows the client to access the network. Otherwise, network
access is denied and the port remains blocked.
The operation of dot1x on the switch requires the following:
• The switch must have an IP address assigned.
• RADIUS authentication must be enabled on the switch and the
IP address of the RADIUS server specified.
• Each switch port that will be used must be set to dot1x “Auto”
mode.
• Each client requiring authentication must have 802.1x client
software installed and be properly configured. The
configuration includes specifying the client identity (user ID)
b_mgmt.book Page 130 Tuesday, July 8, 2003 5:24 PM