Home » Dell Manuals » Servers » Dell Force10 S25-01-GE-24V » Manual Viewer

Dell Force10 S25-01-GE-24V FTOS 8.4.2.6 Configuraiton Guide for the E-Series T - Page 110

supplicant, authenticator, End-user Device, RADIUS Server

View all Dell Force10 S25-01-GE-24V manuals

Add to My Manuals
Save this manual to your list of manuals

Page 110 highlights

www.dell.com | support.dell.com 802.1X employs Extensible Authentication Protocol (EAP)* to transfer a device's credentials to an authentication server (typically RADIUS) via a mandatory intermediary network access device, in this case, a Dell Force10 switch. The network access device mediates all communication between the end-user device and the authentication server so that the network remains secure. The network access device uses EAP over Ethernet (EAPOL) to communicate with the end-user device and EAP over RADIUS to communicate with the server. End-user Device Force10 switch RADIUS Server EAP over LAN (EAPOL) EAP over RADIUS Figure 7-1 and Figure show how EAP frames are encapsulated in Ethernet and Radius frames. * Note: FTOS supports 802.1X with EAP-MD5, EAP-OTP, EAP-TLS, EAP-TTLS, PEAPv0, PEAPv1, and MS-CHAPv2 with PEAP. Figure 7-1. EAPOL Frame Format Preamble Start Frame Destination MAC Source MAC Ethernet Type Delimiter (1:80:c2:00:00:03) (Auth Port MAC) (0x888e) EAPOL Frame Padding FCS Range: 0-4 Type: 0: EAP Packet Protocol Version (1) 1: EAPOL Start 2: EAPOL Logoff 3: EAPOL Key 4: EAPOL Encapsulated-ASF-Alert Packet Type Range: 1-4 Codes: 1: Request 2: Response 3: Success 4: Failure Code (0-4) Length ID (Seq Number) EAP Frame Length Range: 1-255 Codes: 1: Identity 2: Notification 3: NAK 4: MD-5 Challenge 5: One-Time Challenge 6: Generic Token Card EAP-Method Code (0-255) Length EAP-Method Frame EAP-Method Data (Supplicant Requested Credentials) The authentication process involves three devices: • The device attempting to access the network is the supplicant. The supplicant is not allowed to communicate on the network until the port is authorized by the authenticator. It can only communicate with the authenticator in response to 802.1X requests. • The device with which the supplicant communicates is the authenticator. The authenicator is the gate keeper of the network. It translates and forwards requests and responses between the authentication server and the supplicant. The authenticator also changes the status of the port based on the results of the authentication process. The Dell Force10 switch is the authenticator. 110 | 802.1X

Section	Page
About this Guide	35
Objectives	35
Audience	35
Conventions	36
Information Symbols	36
Related Documents	36
Configuration Fundamentals	37
Accessing the Command Line	37
CLI Modes	38
Navigating CLI Modes	39
The do Command	42
Undoing Commands	42
Obtaining Help	43
Entering and Editing Commands	43
Command History	44
Filtering show Command Outputs	45
Multiple Users in Configuration mode	46
Getting Started	47
Default Configuration	48
Configure a Host Name	49
Access the System Remotely	49
Access the C-Series and E-Series Remotely	49
Configure the Management Port IP Address	50
Configure a Management Route	50
Configure a Username and Password	50
Access the S-Series Remotely	51
Configure the Enable Password	52
Configuration File Management	52
Copy Files to and from the System	53
Important Points to Remember	53
Save the Running-configuration	54
View Files	55
View Configuration Files	56
File System Management	57
View command history	58
Upgrading and Downgrading FTOS	58
System Management	59
Configure Privilege Levels	59
Create a Custom Privilege Level	59
Removing a command from EXEC mode	60
Move a command from EXEC Privilege mode to EXEC mode	60
Allow Access to CONFIGURATION mode commands	60
Allow Access to INTERFACE, LINE, ROUTE-MAP, and ROUTER mode	60
Apply a Privilege Level to a Username	63
Apply a Privilege Level to a Terminal Line	63
Configure Logging	63
Log Messages in the Logging Buffer	64
Configuration Task List for System Log Management	64
Disable System Logging	64
Send System Messages to a Syslog Server	65
Configure a Unix System as a Syslog Server	65
Change System Logging Settings	65
Display the Logging Buffer and the Logging Configuration	66
Configure a UNIX Logging Facility Level	68
Synchronize Log Messages	69
Enable Timestamp on Syslog Messages	69
File Transfer Services	70
Configuration Task List for File Transfer Services	70
Enable FTP server	70
Configure FTP server parameters	70
Configure FTP client parameters	71
Terminal Lines	71
Deny and Permit Access to a Terminal Line	71
Configure Login Authentication for Terminal Lines	72
Time out of EXEC Privilege Mode	73
Telnet to Another Network Device	74
Lock CONFIGURATION mode	74
Viewing the Configuration Lock Status	75
Recovering from a Forgotten Password	76
Recovering from a Forgotten Enable Password	77
Recovering from a Forgotten Password on S-Series	78
Recovering from a Failed Start	79
802.1ag	81
Ethernet CFM	81
Maintenance Domains	82
Maintenance Points	82
Maintenance End Points	83
Implementation Information	84
Configure CFM	84
Related Configuration Tasks	84
Enable Ethernet CFM	85
Create a Maintenance Domain	85
Create a Maintenance Association	86
Create Maintenance Points	86
Create a Maintenance End Point	86
Create a Maintenance Intermediate Point	87
MP Databases	87
MP Database Persistence	88
Continuity Check Messages	89
Enable CCM	90
Enable Cross-checking	90
Loopback Message and Response	90
Linktrace Message and Response	90
Link Trace Cache	91
Enable CFM SNMP Traps.	92
Display Ethernet CFM Statistics	93
802.3ah	95
Link Layer OAM Overview	95
Link Layer OAMPDUs	96
OAMPDU Flags	96
Link Layer OAM Operational Modes	97
Link Layer OAM Discovery	97
Link Layer OAM Events	98
Remote Loopback	98
Implementation Information	98
Configure Link Layer OAM	99
Related Configuration Tasks	99
Enable Link Layer OAM	99
Adjust the OAMPDU Transmission Parameters	101
Link Performance Event Monitoring	101
Enable Error Monitoring	101
Set Threshold Values	102
Symbol Errors per Second	102
Frame Errors per Second	103
Frame Errors per Frame Period	103
Error Seconds per Time Period	103
Execute an Action upon Exceeding the High Threshold	104
Remote Failure Indication	104
Remote Loopback	105
Display Link Layer OAM Configuration and Statistics	106
Manage Link Layer OAM	108
Enable MIB Retrieval Support/Function	108
Adjust the Size of the Link OAM Event Log	108
802.1X	109
Protocol Overview	109
The Port-authentication Process	111
EAP over RADIUS	112
RADIUS Attributes for 802.1 Support	113
Configuring 802.1X	113
Related Configuration Tasks	113
Important Points to Remember	114
Enabling 802.1X	114
Configuring Request Identity Re-transmissions	116
Configuring a Quiet Period after a Failed Authentication	116
Forcibly Authorizing or Unauthorizing a Port	117
Re-Authenticating a Port	118
Periodic Re-Authentication	118
Configuring Timeouts	119
Dynamic VLAN Assignment with Port Authentication	121
Guest and Authentication-Fail VLANs	123
Configuring a Guest VLAN	123
Configuring an Authentication-Fail VLAN	124
Multi-Host Authentication	125
Multi-Supplicant Authentication	127
MAC Authentication Bypass	129
MAB in Single-host and Multi-Host Mode	130
MAB in Multi-Supplicant Authentication Mode	130
Dynamic CoS with 802.1X	132
IP Access Control Lists (ACL), Prefix Lists, and Route-maps	135
Overview	135
IP Access Control Lists (ACLs)	136
CAM Profiling, CAM Allocation, and CAM Optimization	136
CAM Profiling	137
User Configurable CAM Allocation	138
CAM optimization	138
Test CAM Usage	138
Implementing ACLs on FTOS	139
ACLs and VLANs	139
ACL Optimization	139
Determine the order in which ACLs are used to classify traffic	140
IP Fragment Handling	140
IP fragments ACL examples	141
Layer 4 ACL rules examples	141
Configure a standard IP ACL	142
Configure an extended IP ACL	145
Configure filters with sequence number	145
Configure filters without sequence number	147
Established Flag	148
Configuring Layer 2 and Layer 3 ACLs on an Interface	148
Assign an IP ACL to an Interface	149
Counting ACL Hits	150
Configuring Ingress ACLs	151
Configuring Egress ACLs	151
Egress Layer 3 ACL Lookup for Control-plane IP Traffic	152
Configuring ACLs to Loopback	153
Applying an ACL on Loopback Interfaces	153
IP Prefix Lists	155
Implementation Information	155
Configuration Task List for Prefix Lists	155
Configure a prefix list	156
Use a prefix list for route redistribution	158
ACL Resequencing	159
Resequencing an ACL or Prefix List	160
Route Maps	162
Implementation Information	162
Important Points to Remember	163
Configuration Task List for Route Maps	163
Create a route map	163
Configure route map filters	165
Configure a route map for route redistribution	168
Configure a route map for route tagging	169
Continue clause	169
Bidirectional Forwarding Detection	171
Protocol Overview	171
How BFD Works	172
BFD packet format	172
BFD sessions	175
BFD three-way handshake	175
Session state changes	176
Important Points to Remember	177
Configuring Bidirectional Forwarding Detection	177
Configuring BFD for Physical Ports	178
Related configuration tasks	178
Enabling BFD globally	178
Establishing a session on physical ports	178
Changing physical port session parameters	180
Disabling and re-enabling BFD	181
Configuring BFD for Static Routes	182
Related configuration tasks	182
Establishing sessions for static routes	182
Changing static route session parameters	183
Disabling BFD for static routes	183
Configuring BFD for OSPF	184
Related configuration tasks	184
Establishing sessions with OSPF neighbors	184
Changing OSPF session parameters	186
Disabling BFD for OSPF	186
Configuring BFD for BGP	187
Prerequisites	187
Establishing sessions with BGP neighbors	187
Disabling BFD for BGP	189
Using BFD in a BGP Peer Group	189
Displaying BFD for BGP Information	190
Configuring BFD for IS-IS	195
Related configuration tasks	195
Establishing sessions with IS-IS neighbors	195
Changing IS-IS session parameters	196
Disabling BFD for IS-IS	197
Configuring BFD for VRRP	197
Related configuration tasks	197
Establishing sessions with all VRRP neighbors	197
Establishing VRRP sessions on VRRP neighbors	198
Changing VRRP session parameters	199
Disabling BFD for VRRP	200
Configuring BFD for VLANs	200
Related configuration tasks	201
Establishing sessions with VLAN neighbors	201
Changing session parameters	202
Disabling BFD for VLANs	202
Configuring BFD for Port-Channels	203
Related configuration tasks	203
Establishing sessions on port-channels	203
Changing port-channel session parameters	204
Disabling BFD for port-channels	204
Configuring Protocol Liveness	205
Troubleshooting BFD	205
Border Gateway Protocol IPv4 (BGPv4)	207
Protocol Overview	208
Autonomous Systems (AS)	208
Sessions and Peers	210
Establishing a session	210
Peer Groups	211
Route Reflectors	211
Confederations	212
Communities	212
BGP Attributes	213
Best Path Selection Criteria	213
Best Path selection details	214
Weight	216
Local Preference	216
Multi-Exit Discriminators (MEDs)	216
Origin	217
AS Path	218
Next Hop	219
Multiprotocol BGP	219
Implementing BGP with FTOS	219
Advertise IGP cost as MED for redistributed routes	219
Ignore Router-ID for some best-path calculations	220
4-Byte AS Numbers	220
AS4 Number Representation	221
Dynamic AS Number Notation application	222
AS Number Migration	223
BGP4 Management Information Base (MIB)	225
Important Points to Remember	225
Configuration Information	226
BGP Configuration	227
Defaults	227
Configuration Task List for BGP	227
Enable BGP	228
Configure AS4 Number Representations	232
Configure Peer Groups	234
BGP fast fall-over	237
Configure passive peering	240
Maintain existing AS numbers during an AS migration	241
Allow an AS number to appear in its own AS path	242
Enable graceful restart	243
Filter on an AS-Path attribute	245
Redistribute routes	248
Configure IP community lists	249
Manipulate the COMMUNITY attribute	252
Change MED attribute	253
Change LOCAL_PREFERENCE attribute	254
Change NEXT_HOP attribute	255
Change WEIGHT attribute	255
Enable multipath	256
Filter BGP routes	256
Configure BGP route reflectors	259
Aggregate routes	260
Configure BGP confederations	260
Enable route flap dampening	261
Change BGP timers	265
BGP neighbor soft-reconfiguration	265
Route map continue	267
MBGP Configuration	268
BGP Regular Expression Optimization	269
Retain NH in BGP Advertisement	269
Debugging BGP	269
Storing Last and Bad PDUs	270
Capturing PDUs	271
PDU Counters	273
Sample Configurations	273
Content Addressable Memory	283
Content Addressable Memory	284
CAM Profiles	284
Microcode	286
CAM Profiling for ACLs	287
Boot Behavior	288
When to Use CAM Profiling	289
Important Points to Remember	290
Differences Between EtherScale and TeraScale	290
Select CAM Profiles	290
CAM Allocation	291
Test CAM Usage	292
View CAM Profiles	293
View CAM-ACL settings	293
View CAM Usage	294
Configure IPv4Flow Sub-partitions	295
Configure Ingress Layer 2 ACL Sub-partitions	297
Return to the Default CAM Configuration	299
CAM Optimization	300
Applications for CAM Profiling	300
LAG Hashing	300
LAG Hashing based on Bidirectional Flow	301
CAM profile for the VLAN ACL group feature	301
Troubleshoot CAM Profiling	301
CAM Profile Mismatches	301
QoS CAM Region Limitation	302
Content Addressable Memory for ExaScale	303
Content Addressable Memory	303
Static Random Access Memory	304
CAM-profile templates	304
Default CAM-profile	305
Recommended CAM-profile templates	306
CAM/SRAM region minimums and maximums	307
Microcode	308
Boot Behavior	309
Select a CAM-profile template	310
Select pre-defined CAM-profile template	310
Create new CAM-profile	312
Assign a microcode to the CAM-profile template	313
Validate CAM-profile templates	313
Show CAM-profile templates	313
Configuration Replace and Rollback	317
Archived Files	317
Configuring Configuration Replace and Rollback	318
Related Configuration Tasks	318
Important Points to Remember	318
Enabling the Archive Service	318
Archiving a Configuration File	319
Viewing the Archive Directory	319
Replacing the Current Running Configuration	319
Rolling Back to the Previous Configuration	320
Configuring an Archive File Maximum	321
Configuring Auto-archive	322
Copying and Deleting an Archive File	323
Viewing and Editing the Contents of an Archive File	323
Viewing the Difference between Configuration Files	324
Dynamic Host Configuration Protocol	327
Protocol Overview	327
DHCP Packet Format and Options	328
Assigning an IP Address using DHCP	329
Implementation Information	330
Configuration Tasks	330
Configure the System to be a DHCP Server	330
Configuration Tasks	331
Related Configuration Tasks	331
Configure the Server for Automatic Address Allocation	331
Create an IP Address Pool	331
Exclude Addresses from the Address Pool	332
Specify an Address Lease Time	332
Specify a Default Gateway	332
Enable DHCP Server	333
Configure a Method of Hostname Resolution	333
Address Resolution using DNS	333
Address Resolution using NetBIOS WINS	334
Allocate Addresses to BOOTP Clients	334
Create Manual Binding Entries	334
Check for Address Conflicts	335
DHCP Clear Commands	336
Configure the System to be a Relay Agent	336
Configure Secure DHCP	337
Option 82	338
DHCP Snooping	338
Enable DCHP snooping	339
Add a static entry in the binding table	340
Clear the binding table	340
Display the contents of the binding table	340
Drop DHCP packets on snooped VLANs only	341
Dynamic ARP Inspection	341
Bypass the ARP Inspection	343
Source Address Validation	343
IP Source Address Validation	344
DHCP MAC Source Address Validation	344
IP+MAC Source Address Validation	344
Equal Cost Multi-Path	347
ECMP for Flow-based Affinity (E-Series)	347
Configurable Hash Algorithm (E-Series)	347
Deterministic ECMP Next Hop	348
Configurable Hash Algorithm Seed	348
Configurable ECMP Hash Algorithm (C- and S-Series)	350
Force10 Resilient Ring Protocol	351
Protocol Overview	351
Ring Status	352
Ring Checking	352
Ring Failure	353
Ring Restoration	353
Multiple FRRP Rings	353
Member VLAN Spanning Two Rings Connected by One Switch	353
Important FRRP Points	354
Important FRRP Concepts	355
Implementing FRRP	356
FRRP Configuration	357
Create the FRRP group	357
Configure the Control VLAN	357
Configure and add the Member VLANs	359
Set FRRP Timers	360
Clear FRRP counters	360
Show FRRP configuration	361
Show FRRP information	361
Troubleshooting FRRP	361
Configuration Checks	361
Sample Configuration and Topology	361
Force10 Service Agent	363
Implementation Information	363
Configure Force10 Service Agent	364
Related Configuration Tasks	364
Enable Force10 Service Agent	364
Specify an SMTP Server for FTSA	365
Provide an Administrator E-mail Address	365
FTSA Messaging Service	366
Enable the FTSA Messaging Service	366
Add Additional Recipients of FTSA E-mails	367
Encrypt FTSA Messages	368
Create a PGP5 encryption key	369
Provide Administrator Contact Information	369
Set the Frequency of FTSA Type 3 Messages	370
Generate FTSA Type 4 Messages	370
Set Parameters FTSA Type 5 Messages	370
FTSA Message Types	371
FTSA Policies	373
Create an FTSA Policy Test List	374
Choose test conditions for a policy test list	374
Set the match criterion for test lists	377
Create a Policy Action List	377
Add actions to a policy action list	378
Create a Policy and Assign a Test and Action List	379
Additional Policy Configurations	380
FTSA Policy Sample Configurations	380
Line card state-change policy configuration	380
Excessive CRC-error policy configuration	385
Debugging FTSA	387
GARP VLAN Registration Protocol	389
Protocol Overview	389
Important Points to Remember	389
Configuring GVRP	390
Related Configuration Tasks	391
Enabling GVRP Globally	391
Enabling GVRP on a Layer 2 Interface	392
Configuring GVRP Registration	392
Configuring a GARP Timer	393
High Availability	395
Component Redundancy	396
RPM Redundancy	396
Boot the chassis with a single RPM	396
Boot the chassis with dual RPMs	397
Automatic and manual RPM failover	398
Communication between RPMs	399
Support for RPM redundancy by FTOS version	400
RPM synchronization	401
RPM redundancy configuration tasks	401
Online Insertion and Removal	403
RPM Online Insertion and Removal	403
Line Card Online Insertion and Removal	403
Pre-configure a line card slot	404
Replace a line card	405
Hitless Behavior	405
Graceful Restart	406
Software Resiliency	406
Runtime System Health Check	407
SFM Channel Monitoring	407
Software Component Health Monitoring	408
System Health Monitoring	408
Failure and Event Logging	408
Trace Log	408
Core Dumps	408
System Log	409
Hot-lock Behavior	409
Warm Upgrade	409
Configure Cache Boot	410
Cache Boot Pre-requisites	410

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301
1,302
1,303
1,304
1,305
1,306
1,307
1,308
1,309
1,310
1,311
1,312

Match case Limit results 1 per page

110

802.1X

www.dell.com | support.dell.com

802.1X employs Extensible Authentication Protocol (EAP)* to transfer a device’s credentials to an

authentication server (typically RADIUS) via a mandatory intermediary network access device, in this

case, a Dell Force10 switch. The network access device mediates all communication between the end-user

device and the authentication server so that the network remains secure. The network access device uses

EAP over Ethernet (EAPOL) to communicate with the end-user device and EAP over RADIUS to

communicate with the server.

Figure 7-1

and

Figure

show how EAP frames are encapsulated in Ethernet and Radius frames.

Figure 7-1.

EAPOL Frame Format

The authentication process involves three devices:

•

The device attempting to access the network is the

supplicant

. The supplicant is not allowed to

communicate on the network until the port is authorized by the authenticator. It can only communicate

with the authenticator in response to 802.1X requests.

•

The device with which the supplicant communicates is the

authenticator

. The authenicator is the gate

keeper of the network. It translates and forwards requests and responses between the authentication

server and the supplicant. The authenticator also changes the status of the port based on the results of

the authentication process. The Dell Force10 switch is the authenticator.

Note:

FTOS supports 802.1X with EAP-MD5, EAP-OTP, EAP-TLS, EAP-TTLS, PEAPv0, PEAPv1, and

MS-CHAPv2 with PEAP.

End-user Device

Force10 switch

RADIUS Server

EAP over LAN (EAPOL)

EAP over RADIUS

Preamble

Start Frame

Delimiter

Destination MAC

(1:80:c2:00:00:03)

Source MAC

(Auth Port MAC)

Ethernet Type

(0x888e)

Protocol Version

(1)

Packet Type

EAPOL Frame

Length

Code

(0-4)

(Seq Number)

EAP-Method Frame

Length

EAP-Method

Code

(0-255)

Length

EAP-Method Data

(Supplicant Requested Credentials)

Range:

0-4

Type:

0: EAP Packet

1: EAPOL Start

2: EAPOL Logoff

3: EAPOL Key

4: EAPOL Encapsulated-ASF-Alert

Range:

0-4

Type:

0: EAP Packet

1: EAPOL Start

2: EAPOL Logoff

3: EAPOL Key

4: EAPOL Encapsulated-ASF-Alert

EAP Frame

Padding

FCS

Range: 1-4

Codes: 1:

Request

Response

Success

Failure

Range: 1-255

Codes: 1:

Identity

Notification

NAK

MD-5 Challenge

5: One-Time Challenge

6: Generic Token Card