Dell N3200-ON EMC Networking N-Series Switches CLI Reference Guide version 6.7 - Page 948

The Internal Authentication Server feature provides support for the creation of users for IEEE 802.1x access only, i.e. without switch management access. This feature maintains a separate database of users allowed for 802.1x access. The authentication method ias is available in the list of methods supported by authentication to support user database lookup. The ias method cannot be added in the same authentication list that has other methods like local, radius and reject. Whenever an operator configures a port in 802.1x authentication mode and selects the authentication method as ias, then the user credentials received from the 802.1x supplicant are validated against the user database by the 802.1x component. The 802.1x application accesses the 802.1x user database to check whether the user credentials present in the authentication message corresponds to a valid user or not. If so then an event is generated which triggers the 802.1x state machine to send a challenge to the supplicant. Otherwise a failure is returned to the 802.1x state machine and the user is not granted access to the port. If user(s) credentials are changed, the existing user connection(s) are not disturbed and the changed user(s) credentials are only used when a new EAP request arises. A CLI configuration mode is added in order to configure 802.1x users and their attributes. The 802.1x maintained user database can also be exported (uploaded) or imported (downloaded) to/from a central location using a TFTP server. Use the aaa ias-user username command to add users to the internal database. MAC Authentication Bypass Today, IEEE 802.1x has become the recommended port-based authentication method at the access layer in enterprise networks. However, there may be 802.1x unaware devices such as printers, fax-machines, etc., that would require access to the network without 802.1x authentication. MAC Authentication Bypass (MAB) is a supplemental authentication mechanism to allow 802.1x unaware clients to authenticate to the network. It uses the 802.1x infrastructure. MAB cannot be supported independently of the 802.1x component. Security Commands 948