Interlogix NS3502-8P-2S User Manual - Manual (Page 229)

IFS NS3502-8P-2S User Manual
229
involved in this authentication, and therefore, MAC-based Authentication has nothing to do with the
802.1X standard.
The advantage of MAC-based authentication over 802.1X is that several clients can be connected to the
same port (e.g. through a 3rd party switch or a hub) and still require individual authentication, and that
the clients don't need special supplicant software to authenticate. The disadvantage is that MAC
addresses can be spoofed by malicious users, equipment whose MAC address is a valid RADIUS user
can be used by anyone, and only the MD5-Challenge method is supported.
The 802.1X and MAC-Based Authentication configuration consists of two sections, a system- and a
port-wide.
Overview of User Authentication
It is allowed to configure the Managed Switch to authenticate users logging into the system for
management access using local or remote authentication methods, such as telnet and Web browser.
This Managed Switch provides secure network management access using the following options:
 Remote Authentication Dial-in User Service (RADIUS)
 Terminal Access Controller Access Control System Plus (TACACS+)
 Local user name and Privilege Level control
RADIUS and TACACS+ are logon authentication protocols that use software running on a central server
to control access to RADIUS-aware or TACACS-aware devices on the network. An authentication server
contains a database of multiple user name / password pairs with associated privilege levels for each
user that requires management access to the Managed Switch.
4.11.1 Understanding IEEE 802.1X Port-Based Authentication
The IEEE 802.1X standard defines a client-server-based access control and authentication protocol that
restricts unauthorized clients from connecting to a LAN through publicly accessible ports. The
authentication server authenticates each client connected to a switch port before making available any
services offered by the switch or the LAN.
Until the client is authenticated, 802.1X access control allows only Extensible Authentication Protocol
over LAN (EAPOL) traffic through the port to which the client is connected. After authentication is
successful, normal traffic can pass through the port.
This section includes this conceptual information:
• Device Roles
• Authentication Initiation and Message Exchange
• Ports in Authorized and Unauthorized States