Interlogix NS3702-24P-4S User Manual - Manual (Page 252)

252
The Page includes the following fields:
Object Description
 Client The management client for which the configuration below applies.
 Authentication Method Authentication Method can be set to one of the following values:
■ None : authentication is disabled and login is not possible.
■ Local : use the local user database on the switch stack for authentication.
■ RADIUS : use a remote RADIUS server for authentication.
■ TACACS+ : use a remote TACACS+ server for authentication.
Methods that involves remote servers are timed out if the remote servers are
offline. In this case the next method is tried. Each method is tried from left to right
and continues until a method either approves or rejects a user. If a remote server
is used for primary authentication it is recommended to configure secondary
authentication as 'local'. This will enable the management client to login via the
local user database if none of the configured authentication servers are alive.
Buttons
: Click to apply changes
: Click to undo any changes made locally and revert to previously saved values.
4.11.3 Network Access Server Configuration
This Page allows you to configure the IEEE 802.1X and MAC-based authentication system and port settings.
The IEEE 802.1X standard defines a port-based access control procedure that prevents unauthorized access to a network by
requiring users to first submit credentials for authentication. One or more central servers, the backend servers, determine whether
the user is allowed access to the network. These backend (RADIUS) servers are configured on the "Configuration→Security→AAA"
Page. The IEEE802.1X standard defines port-based operation, but non-standard variants overcome security limitations as shall be
explored below.
MAC-based authentication allows for authentication of more than one user on the same port, and doesn't require the user to have
special 802.1X supplicant software installed on his system. The switch uses the user's MAC address to authenticate against the
backend server. Intruders can create counterfeit MAC addresses, which makes MAC-based authentication less secure than 802.1X
authentication. The NAS configuration consists of two sections, a system- and a port-wide. The Network Access Server
Configuration screen in Figure 4-11-4 appears.