C
HAPTER
15
| Security Commands
Network Access Server Commands
– 358 –
module. Only then will frames from the client be forwarded on the
switch. There are no EAPOL frames involved in this authentication,
and therefore, MAC-based Authentication has nothing to do with the
802.1X standard.
The advantage of MAC-based authentication over port-based
802.1X is that several clients can be connected to the same port
(e.g. through a 3rd party switch or a hub) and still require individual
authentication, and that the clients don't need special supplicant
software to authenticate. The advantage of MAC-based
authentication over 802.1X-based authentication is that the clients
don't need special supplicant software to authenticate. The
disadvantage is that MAC addresses can be spoofed by malicious
users - equipment whose MAC address is a valid RADIUS user can
be used by anyone. Also, only the MD5-Challenge method is
supported. The maximum number of clients that can be attached to
a port can be limited using the Port Security Limit Control
functionality.
DEFAULT SETTING
All ports
Authorized
COMMAND USAGE
◆ Port Admin state can only be set to Force-Authorized for ports
participating in the Spanning Tree algorithm (see the stp port mode
command on page 409).
◆ When 802.1X authentication is enabled on a port, the MAC address
learning function for this interface is disabled, and the addresses
dynamically learned on this port are removed from the common
address table.
◆ Authenticated MAC addresses are stored as dynamic entries in the
switch's secure MAC address table. Configured static MAC addresses
are added to the secure address table when seen on a switch port (see
the mac add command on page 294). Static addresses are treated as
authenticated without sending a request to a RADIUS server.
◆ When port status changes to down, all MAC addresses are cleared from
the secure MAC address table. Static VLAN assignments are not
restored.
EXAMPLE
Security/Network/NAS>state 2 authorized
Security/Network/NAS>state 2
Port Admin State Port State Last Source Last ID
---- ------------------ --------------------- ----------------- -----------
2 Force Authorized Globally Disabled - -
Security/Network/NAS>
To Next Page
