233
Port Configuration
The table has one row for each port on the selected switch and a number of
columns, which are:
Port:
The port number for which the configuration below applies.
Admin State:
If the NAS is globally enabled, “Admin State” controls the port's
authentication mode. The following modes are available:
Forced Authorized:
In this mode, the switch will send one EAPOL success
frame when the port link comes up. Any client on the port will be allowed
network access without authentication.
Forced Unauthorized:
In this mode, the switch will send one EAPOL failure
frame when the port link comes up. Any client on the port will be
disallowed network access.
Port-Based 802.1X:
In the 802.1X-world, the user is called the supplicant,
the switch is the authenticator, and the RADIUS server is the authentication
server. The authenticator acts as the middleman. The authenticator
forwards requests and responses between the supplicant and the
authentication server. Frames sent between the supplicant and the switch
is special 802.1X frames, known as EAPOL (EAP Over LANs) frames. EAPOL
frames encapsulate EAP PDUs (RFC3748). Frames sent between the switch
and the RADIUS server are the RADIUS packets. RADIUS packets also
encapsulate EAP PDUs together with other attributes (switch's IP address,
name, and the supplicant's port number) on the switch. EAP allows
different authentication methods (MD5-Challenge, PEAP, and TLS). The
authenticator (the switch) doesn't need to know which authentication
method the supplicant and the authentication server are using, or how
many information exchange frames are needed for a particular method.
The switch simply encapsulates the EAP part of the frame into the relevant
type (EAPOL or RADIUS) and forwards it.
When authentication is complete, the RADIUS server sends a special packet
that contains a success or failure indication. Aside from forwarding this
decision to the supplicant, the switch also uses it to open or block traffic on
the switch port connected to the supplicant.
NOTE:
Supposed two backend servers are enabled and that
the server timeout is configured to X seconds (using the AAA
configuration page), and that the first server in the list is
currently down (but not considered dead).
Now, if the supplicant retransmits the EAPOL start frames at
a rate faster than X seconds, then it will never get
authenticated because the switch will cancel the on-going
backend authentication server requests whenever it receives
a new EAPOL start frame from the supplicant.
And since the server hasn't yet failed (because the X seconds
haven't expired), the same server will be contacted upon the
next backend authentication server request from the switch.
This scenario will loop forever. Therefore, the server timeout
should be smaller than the supplicant's EAPOL start frame
retransmission rate.
