INS_CNXE2GE2TX8MSPOE 11 Jan 2021 PAGE 162
INSTALLATION AND OPERATION MANUAL
CNXE2GE2TX8MSPOE
TECH SUPPORT: 1.888.678.9427
Label
Description
Admin State (cont’d) Frames sent between the switch and the RADIUS server is RADIUS packets.
RADIUS packets also encapsulate EAP PDUs together with other attributes like the
switch’s IP address, name, and the supplicant’s port number on the switch. EAP is
very flexible as it allows for different authentication methods, like MD5-Challenge,
PEAP, and TLS. The important thing is that the authenticator (the switch) does not
need to know which authentication method the supplicant and the authentication
server are using, or how many information exchange frames are needed for a
particular method. The switch simply encapsulates the EAP part of the frame into
the relevant type (EAPOL or RADIUS) and forwards it.
When authentication is complete, the RADIUS server sends a special packet
containing a success or failure indication. Besides forwarding the result to the
supplicant, the switch uses it to open up or block traffic on the switch port
connected to the supplicant.
Note: in an environment where two backend servers are enabled, the server
timeout is configured to X seconds (using the
authentication configuration page), and the first server in the list is currently down
(but not considered dead), if the supplicant retransmits EAPOL Start frames at a
rate faster than X seconds, it will never be authenticated because the switch will
cancel on-going backend authentication server requests whenever it receives
a new EAPOL Start frame from the supplicant. Since the server has not failed
(because the X seconds have not expired), the same server will be contacted when
the next backend authentication server request from the switch This scenario will
loop forever. Therefore, the server timeout should be smaller than the supplicant’s
EAPOL Start frame retransmission rate.
a. Single 802.1X
In port-based 802.1X authentication, once a supplicant is successfully
authenticated on a port, the whole port is opened for network traffic. This allows
other clients connected to the port (for instance through a hub) to piggy-back on
the successfully authenticated client and get network access even though they are
not authenticated individually. To overcome this security breach, use the Single
802.1X variant.
Single 802.1X is not yet an IEEE standard, but features many of the same
characteristics as port-based 802.1X. In Single 802.1X, at most one supplicant
can get authenticated on the port at a time. Normal EAPOL frames are used in
the communications between the supplicant and the switch. If more than one
supplicant are connected to a port, the one that comes first when the port’s link is
connected will be the first one considered. If that supplicant does not provide valid
credentials within a certain amount of time, the chance will be given to another
supplicant. Once a supplicant is successfully authenticated, only that supplicant
will be allowed access. This is the most secure of all the supported modes. In this
mode, the Port Security module is used to secure a supplicant’s MAC address once
successfully authenticated.
