Home » TP-Link Manuals » Hubs & Switches » TP-Link T2700G-28TQ » Manual Viewer

TP-Link T2700G-28TQ T2700G-28TQ User Guide V1 - Page 330

PAP Authentication Procedure, EAP Terminating Mode

View all TP-Link T2700G-28TQ manuals

Add to My Manuals
Save this manual to your list of manuals

Page 330 highlights

(4) Upon receiving the user name from the switch, the RADIUS server retrieves the user name, finds the corresponding password by matching the user name in its database, encrypts the password using a randomly-generated key, and sends the key to the switch through an RADIUS Access-Challenge packet. The switch then sends the key to the 802.1X client program. (5) Upon receiving the key (encapsulated in an EAP-Request/MD5 Challenge packet) from the switch, the client program encrypts the password of the supplicant system with the key and sends the encrypted password (contained in an EAP-Response/MD5 Challenge packet) to the RADIUS server through the switch. (The encryption is irreversible.) (6) The RADIUS server compares the received encrypted password (contained in a RADIUS Access-Request packet) with the locally-encrypted password. If the two match, it will then send feedbacks (through a RADIUS Access-Accept packet and an EAP-Success packet) to the switch to indicate that the supplicant system is authorized. (7) The switch changes the state of the corresponding port to accepted state to allow the supplicant system access the network. And then the switch will monitor the status of supplicant by sending hand-shake packets periodically. By default, the switch will force the supplicant to log off if it cannot get the response from the supplicant for two times. (8) The supplicant system can also terminate the authenticated state by sending EAPOL-Logoff packets to the switch. The switch then changes the port state from accepted to rejected. 2. EAP Terminating Mode In this mode, packet transmission is terminated at authenticator systems and the EAP packets are mapped into RADIUS packets. Authentication and accounting are accomplished through RADIUS protocol. In this mode, PAP or CHAP is employed between the switch and the RADIUS server. This switch supports the PAP terminating mode. The authentication procedure of PAP is illustrated in the following figure. Figure 14-21 PAP Authentication Procedure In PAP mode, the switch encrypts the password and sends the user name, the randomly-generated key, and the supplicant system-encrypted password to the RADIUS server for further authentication. Whereas the randomly-generated key in EAP-MD5 relay mode is generated by the authentication server, and the switch is responsible to encapsulate the authentication packet and forward it to the RADIUS server. 318

Section	Page
Package Contents	13
Chapter 1 About This Guide	14
1.1 Intended Readers	14
1.2 Conventions	14
1.3 Overview of This Guide	14
Chapter 2 Introduction	19
2.1 Overview of the Switch	19
2.2 Main Features	19
2.3 Appearance Description	21
2.3.1 Front Panel	21
2.3.2 Rear Panel	23
Chapter 3 Login to the Switch	24
3.1 Login	24
3.2 Configuration	25
Chapter 4 System	26
4.1 System Info	26
4.1.1 System Summary	26
4.1.2 Device Description	28
4.1.3 System Time	28
4.1.4 License Info	30
4.1.5 Daylight Saving Time	31
4.2 User Management	32
4.2.1 User Table	32
4.2.2 User Config	32
4.3 System Tools	34
4.3.1 Boot Config	34
4.3.2 Config Restore	35
4.3.3 Config Backup	36
4.3.4 Firmware Upgrade	36
4.3.5 License Load	37
4.3.6 System Reboot	37
4.3.7 System Reset	38
4.4 Access Security	38
4.4.1 Access Control	38
4.4.2 SSL Config	40
4.4.3 SSH Config	41
Chapter 5 Stack	48
5.1 Stack Management	54
5.1.1 Stack Info	54
5.1.2 Stack Config	55
5.1.3 Switch Renumber	56
5.2 Application Example for Stack	57
Chapter 6 Switching	59
6.1 Port	59
6.1.1 Port Config	59
6.1.2 Port Mirror	60
6.1.3 Port Security	62
6.1.4 Port Isolation	64
6.1.5 Loopback Detection	65
6.2 LAG	67
6.2.1 LAG Table	68
6.2.2 Static LAG	69
6.2.3 LACP Config	70
6.3 Traffic Monitor	72
6.3.1 Traffic Summary	72
6.3.2 Traffic Statistics	73
6.4 MAC Address	75
6.4.1 Address Table	76
6.4.2 Static Address	78
6.4.3 Dynamic Address	79
6.4.4 Filtering Address	81
Chapter 7 VLAN	83
7.1 802.1Q VLAN	84
7.1.1 VLAN Config	85
7.1.2 Port Config	87
7.2 Application Example for 802.1Q VLAN	89
7.3 MAC VLAN	90
7.3.1 MAC VLAN	91
7.3.2 Port Enable	92
7.4 Application Example for MAC VLAN	92
7.5 Protocol VLAN	94
7.5.1 Protocol Group Table	95
7.5.2 Protocol Group	96
7.5.3 Protocol Template	96
7.6 Application Example for Protocol VLAN	98
7.7 VLAN VPN	100
7.7.1 VPN Config	101
7.7.2 Port Enable	101
7.7.3 VLAN Mapping	102
7.8 GVRP	104
7.9 Private VLAN	108
7.9.1 PVLAN Config	109
7.9.2 Port Config	110
7.10 Application Example for Private VLAN	111
Chapter 8 Spanning Tree	114
8.1 STP Config	119
8.1.1 STP Config	119
8.1.2 STP Summary	121
8.2 Port Config	122
8.3 MSTP Instance	123
8.3.1 Region Config	123
8.3.2 Instance Config	124
8.3.3 Instance Port Config	125
8.4 STP Security	127
8.4.1 Port Protect	127
8.4.2 TC Protect	130
8.5 Application Example for STP Function	130
Chapter 9 Multicast	135
9.1 IGMP Snooping	137
9.1.1 Snooping Config	138
9.1.2 Port Config	140
9.1.3 VLAN Config	141
9.1.4 Multicast VLAN	142
9.1.5 Querier Config	144
9.2 Application Example for Multicast VLAN	146
9.3 Multicast IP	147
9.3.1 Multicast IP Table	147
9.3.2 Static Multicast IP	148
9.4 Multicast Filter	150
9.4.1 Profile Config	150
9.4.2 Profile Binding	152
9.5 Packet Statistics	153
Chapter 10 Routing	155
10.1 Interface	155
10.2 Routing Table	158
10.3 Static Routing	158
10.3.1 Static Routing	158
10.3.2 Application Example for Static Routing	159
10.4 DHCP Server	160
10.4.1 DHCP Server	166
10.4.2 Pool Setting	168
10.4.3 Manual Binding	169
10.4.4 Binding Table	169
10.4.5 Packet Statistics	170
10.4.6 Application Example for DHCP Server and Relay	172
10.5 DHCP Relay	173
10.5.1 Global Config	175
10.5.2 DHCP Server	176
10.6 Proxy ARP (License Required)	177
10.6.1 Proxy ARP	178
10.6.2 Application Example for Proxy ARP	179
10.7 ARP	180
10.8 RIP	180
10.8.1 Basic Config	183
10.8.2 Interface Config	185
10.8.3 RIP Database	186
10.8.4 Application Example for RIP	187
10.9 OSPF (License Required)	188
10.9.1 Process	205
10.9.2 Basic	206
10.9.3 Network	208
10.9.4 Interface	209
10.9.5 Area	213
10.9.6 Area Aggregation	214
10.9.7 Virtual Link	216
10.9.8 Route Redistribution	217
10.9.9 ASBR Aggregation	218
10.9.10 Neighbor Table	219
10.9.11 Link State Database	221
10.9.12 Application Example for OSPF	221
10.10 VRRP (License Required)	223
10.10.1 Basic Config	227
10.10.2 Advanced Config	229
10.10.3 Virtual IP Config	230
10.10.4 Track Config	231
10.10.5 Virtual Router Statistics	232
10.10.6 Application Example for VRRP	234
Chapter 11 Multicast Routing (License Required)	236
11.1 Global Config	237
11.1.1 Global Config	237
11.1.2 Mroute Table	238
11.2 IGMP	239
11.2.1 Interface Config	243
11.2.2 Interface State	244
11.2.3 Static Multicast Config	245
11.2.4 Multicast Group Table	247
11.2.5 Profile Binding	248
11.2.6 Packet Statistics	250
11.2.7 Application Example for IGMP	251
11.3 PIM DM	252
11.3.1 PIM DM Interface	257
11.3.2 PIM DM Neighbor	257
11.3.3 Application Example for PIM DM	259
11.4 PIM SM	260
11.4.1 PIM SM Interface	266
11.4.2 PIM SM Neighbor	266
11.4.3 BSR	267
11.4.4 RP	269
11.4.5 RP Mapping	270
11.4.6 RP Info	271
11.4.7 Application Example for PIM SM	272
11.5 Static Mroute	273
11.5.1 Static Mroute Config	274
11.5.2 Static Mroute Table	275
11.5.3 Application Example for Static Mroute	275
Chapter 12 QoS	278
12.1 DiffServ	281
12.1.1 Port Priority	281
12.1.2 Schedule Mode	282
12.1.3 802.1P Priority	283
12.1.4 DSCP Priority	284
12.2 Bandwidth Control	286
12.2.1 Rate Limit	286
12.2.2 Storm Control	287
12.3 Voice VLAN	288
12.3.1 Global Config	290
12.3.2 Port Config	291
12.3.3 OUI Config	292
Chapter 13 ACL	294
13.1 Time-Range	294
13.1.1 Time-Range Summary	294
13.1.2 Time-Range Create	295
13.1.3 Holiday Config	296
13.2 ACL Config	296
13.2.1 ACL Summary	297
13.2.2 ACL Create	297
13.2.3 MAC ACL	298
13.2.4 Standard-IP ACL	298
13.2.5 Extend-IP ACL	299
13.3 Policy Config	301
13.3.1 Policy Summary	301
13.3.2 Policy Create	301
13.3.3 Action Create	302
13.4 Policy Binding	303
13.4.1 Binding Table	303
13.4.2 Port Binding	304
13.4.3 VLAN Binding	305
13.5 Application Example for ACL	306
Chapter 14 Network Security	308
14.1 IP-MAC Binding	308
14.1.1 Binding Table	308
14.1.2 Manual Binding	309
14.1.3 ARP Scanning	311
14.2 DHCP Snooping	313
14.2.1 Global Config	316
14.2.2 Port Config	317
14.3 ARP Inspection	318
14.3.1 ARP Detect	321
14.3.2 ARP Defend	323
14.3.3 ARP Statistics	324
14.4 IP Source Guard	325
14.5 DoS Defend	326
14.5.1 DoS Defend	327
14.6 802.1X	328
14.6.1 Global Config	331
14.6.2 Port Config	333
14.6.3 Radius Server	334
Chapter 15 SNMP	336
15.1 SNMP Config	338
15.1.1 Global Config	338
15.1.2 SNMP View	339
15.1.3 SNMP Group	340
15.1.4 SNMP User	341
15.1.5 SNMP Community	343
15.2 Notification	345
15.3 RMON	347
15.3.1 Statistics	347
15.3.2 History	348
15.3.3 Event	349
15.3.4 Alarm	350
Chapter 16 LLDP	353
16.1 Basic Config	356
16.1.1 Global Config	356
16.1.2 Port Config	357
16.2 Device Info	358
16.2.1 Local Info	359
16.2.2 Neighbor Info	360
16.3 Device Statistics	361
16.4 LLDP-MED	362
16.4.1 Global Config	363
16.4.2 Port Config	364
16.4.3 Local Info	366
16.4.4 Neighbor Info	367
Chapter 17 Cluster	369
17.1 NDP	370
17.1.1 Neighbor Info	370
17.1.2 NDP Summary	371
17.1.3 NDP Config	372
17.2 NTDP	373
17.2.1 Device Table	373
17.2.2 NTDP Summary	375
17.2.3 NTDP Config	376
17.3 Cluster	377
17.3.1 Cluster Summary	377
17.3.2 Cluster Config	380
17.3.3 Member Config	383
17.3.4 Cluster Topology	384
17.4 Application Example for Cluster Function	386
Chapter 18 Maintenance	388
18.1 System Monitor	388
18.1.1 CPU Monitor	389
18.1.2 Memory Monitor	390
18.2 Log	390
18.2.1 Log Table	391
18.2.2 Local Log	392
18.2.3 Remote Log	393
18.2.4 Backup Log	394
18.3 Device Diagnostics	394
18.3.1 Cable Test	394
18.3.2 Loopback	396
18.4 Network Diagnostics	396
18.4.1 Ping	396
18.4.2 Tracert	397
Chapter 19 System Maintenance via FTP	399
Appendix A: Specifications	405
Appendix B: Configuring the PCs	407
Appendix C: 802.1X Client Software	409

Match case Limit results 1 per page

318

(4) Upon receiving the user name from the switch, the RADIUS server retrieves the user name,

finds the corresponding password by matching the user name in its database, encrypts the

password using a randomly-generated key, and sends the key to the switch through an

RADIUS Access-Challenge packet. The switch then sends the key to the 802.1X client

program.

(5) Upon receiving the key (encapsulated in an EAP-Request/MD5 Challenge packet) from the

switch, the client program encrypts the password of the supplicant system with the key and

sends the encrypted password (contained in an EAP-Response/MD5 Challenge packet) to

the RADIUS server through the switch. (The encryption is irreversible.)

(6) The RADIUS server compares the received encrypted password (contained in a RADIUS

Access-Request packet) with the locally-encrypted password. If the two match, it will then

send feedbacks (through a RADIUS Access-Accept packet and an EAP-Success packet) to

the switch to indicate that the supplicant system is authorized.

(7) The switch changes the state of the corresponding port to accepted state to allow the

supplicant system access the network. And then the switch will monitor the status of

supplicant by sending hand-shake packets periodically. By default, the switch will force the

supplicant to log off if it cannot get the response from the supplicant for two times.

(8) The supplicant system can also terminate the authenticated state by sending EAPOL-Logoff

packets to the switch. The switch then changes the port state from accepted to rejected.

EAP Terminating Mode

In this mode, packet transmission is terminated at authenticator systems and the EAP packets are

mapped into RADIUS packets. Authentication and accounting are accomplished through RADIUS

protocol.

In this mode, PAP or CHAP is employed between the switch and the RADIUS server. This switch

supports the PAP terminating mode. The authentication procedure of PAP is illustrated in the

following figure.

Figure 14-21 PAP Authentication Procedure

In PAP mode, the switch encrypts the password and sends the user name, the

randomly-generated key, and the supplicant system-encrypted password to the RADIUS server for

further authentication. Whereas the randomly-generated key in EAP-MD5 relay mode is generated

by the authentication server, and the switch is responsible to encapsulate the authentication

packet and forward it to the RADIUS server.