Netgear FS728TLP Web Management User Guide - Page 315

Port Access Entity Roles, 802.1X Sample Configuration, Authenticator, Supplicant

Get Netgear FS728TLP PDF manuals and user guides View all Netgear FS728TLP manuals
Add to My Manuals
Save this manual to your list of manuals

Page 315 highlights

ProSAFE FS526Tv2, FS726Tv2, and FS728TLP Smart Switches The ports of an 802.1X authenticator smart switch can offer services to other systems that can be reached over the LAN. Port-based network access control allows you to control the ports of the smart switch to ensure that only systems that are authorized to access its services can do so. Access control enforces authentication of supplicants that are attached to an authenticator's controlled port. The result of the authentication process determines whether the supplicant is authorized to access services on that controlled port. Port Access Entity Roles A port access entity (PAE) can adopt one of two distinct roles within an access control interaction: • Authenticator. A port that enforces authentication before allowing access to services available through that port. • Supplicant. A port that attempts to access services offered by the authenticator. In addition, a third role exists: • Authentication server. A server that authenticates the supplicant on behalf of the authenticator. All three roles are required for an authentication exchange to be completed. The smart switch supports the authenticator role only, in which the PAE is responsible for communicating with the supplicant. The authenticator PAE also submits the information that it receives from the supplicant to the authentication server. Depending on the outcome of the RADIUS-based authentication process, the authenticator PAE sets the state of the port to authorized or unauthorized. Supplicant Authenticator switch Authentication server (RADIUS) 192.168.10.23 Supplicant Figure 17. Supplicants, authenticator, and authentication server 802.1X Sample Configuration This example shows how to configure the smart switch so that 802.1X-based authentication is required on ports e1 through e8 in a corporate conference room. These ports are available to visitors and must be authenticated before access to the network is granted. An external Configuration Examples 315

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
  • 297
  • 298
  • 299
  • 300
  • 301
  • 302
  • 303
  • 304
  • 305
  • 306
  • 307
  • 308
  • 309
  • 310
  • 311
  • 312
  • 313
  • 314
  • 315
  • 316
  • 317
  • 318
  • 319
  • 320
  • 321
  • 322
  • 323
  • 324
  • 325
  • 326
  • 327
  • 328
  • 329
  • 330
  • 331
  • 332
  • 333
  • 334
  • 335
Configuration Examples
315
ProSAFE FS526Tv2, FS726Tv2, and FS728TLP Smart Switches
The ports of an 802.1X authenticator smart switch can offer services to other systems that
can be reached over the LAN. Port-based network access control allows you to control the
ports of the smart switch to ensure that only systems that are authorized to access its
services can do so.
Access control enforces authentication of supplicants that are attached to an authenticator’s
controlled port. The result of the authentication process determines whether the supplicant is
authorized to access services on that controlled port.
Port Access Entity Roles
A port access entity (PAE) can adopt one of two distinct roles within an access control
interaction:
•
Authenticator
. A port that enforces authentication before allowing access to services
available through that port.
•
Supplicant
. A port that attempts to access services offered by the authenticator.
In addition, a third role exists:
•
Authentication server
. A server that authenticates the supplicant on behalf of the
authenticator.
All three roles are required for an authentication exchange to be completed.
The smart switch supports the authenticator role only, in which the PAE is responsible for
communicating with the supplicant. The authenticator PAE also submits the information that it
receives from the supplicant to the authentication server. Depending on the outcome of the
RADIUS-based authentication process, the authenticator PAE sets the state of the port to
authorized or unauthorized.
Supplicant
Supplicant
Authenticator
switch
Authentication
server (RADIUS)
192.168.10.23
Figure 17. Supplicants, authenticator, and authentication server
802.1X Sample Configuration
This example shows how to configure the smart switch so that 802.1X-based authentication
is required on ports e1 through e8 in a corporate conference room. These ports are available
to visitors and must be authenticated before access to the network is granted. An external