Supermicro AOC-XEH-IN2 Uživatelský manuál stáhnout pdf (Strana 90)

Superblade Network Modules User’s Manual

6-26

6-11 IEEE 802.1x

IEEE 802.1x is a client-server based access control and authentication protocol that

restricts unauthorized user devices from connecting to the LAN through publicly

accessible ports. This port-based access control is accomplished by using a RADIUS

server that is connected to a gigabit switch management port to authenticate client

users trying to access a network through the switch. The gigabit switch will relay

Extensible Authentication Protocol over LAN (EAPoL) packets between the user client

and the RADIUS server. The 802.1x protocol consists of three components: client,

authenticator and authentication server.

The Authentication Server is a remote device that runs the RADIUS server program

(Windows 2000/2003 IAS™, freeRADIUS™ from open source). The role of the

Authentication Server is to certify the identity of a client attempting to access the

network. By exchanging secure information between the RADIUS server and the client

through EAPoL packets, the Authentication Server will inform the switch whether or not

the client is granted access to the LAN through the connected port.

The client is a workstation that wishes to access the network through a connected

switch port. All workstations have to run a program (supplicant) that is compliant with the

802.1x protocol. Microsoft Windows XP™ and Vista™ should have this. A user can also

install another third party package, such as Odyssey® from Funk Software®.

When the G

LOBAL RADIUS SETTING and SET STATUS of an individual port are enabled,

that port will initially be placed into an unauthorized state. The client will initiate

negotiations by sending an EAPOL

START packet.

There are several EAP authentication methods available in Microsoft Windows XP, such

as EAP-MD5, EAP-TLS and EAP-PEAP. Currently, the gigabit switch only supports

EAP-MD5 for 802.1x authentication.

• PEAP-MS-CHAP v2 uses password-based credentials and requires computer

certificates on the RADIUS servers.

• EAP-TLS uses certificate-based credentials and requires user and computer

certificates on the wire’s client computers and computer certificates on the RADIUS

servers.

• EAP-MD5 (Message Digest 5) Challenge Handshake Authentication Protocol (MD5

CHAP), which uses passwords.

Wiring for 802.1x

The EAPOL packets are handled by a management processor in the switch. The

processor communicates with the outside world through three ports. Two ports (eth0

and eth1) are connected to the CMM module's Ethernet port and the third port (eth2) is

connected to all 24 switching ports. Only one port is enabled at any time. The regular

configuration setup switch is managed through the CMM Ethernet port. Thus, for regular

deployment, the RADIUS server should be located where it can be reached from the

CMM Ethernet port.

1 2 ... 85 86 87 88 89 90 91 92 93 94 95 ... 391 392

Komentáře k této Příručce

Žádné komentáře

Supermicro AOC-XEH-IN2 Uživatelský manuál Strana 90

Komentáře k této Příručce

Související produkty a manuály pro Síťové karty Supermicro AOC-XEH-IN2