EasyManuals Logo

Enterasys SecureStack B3 User Manual

Enterasys SecureStack B3
582 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #510 background imageLoading...
Page #510 background image
Overview of Security Methods
20-2 Security Configuration
SecureStackB3ports.FordetailsonusingCLIcommandstoconfigure802.1X,referto
“Configuring802.1XAuthentication”onpage 20‐9.
•MACAuthentication–providesamechanismforadministratorstosecurelyauthenticate
sourceMACaddressesandgrantappropriateaccesstoenduserdevicescommunicatingwith
SecureStackB3ports.Fordetails,refer
to“ConfiguringMACAuthentication”onpage 20‐19.
•MultipleAuthenticationMethods–allowsuserstoauthenticateusingmultiplemethodsof
authenticationonthesameport.Fordetails,referto“ConfiguringMultipleAuthentication
Methods”onpage 20‐30.
•Multi‐UserAuthentication–OntheSecureStackB3,theonlytypeofmultipleuser
authentication
supportedis“User+IPPhone”.TheUser+IPPhoneauthenticationfeature
supportsauthenticationandauthorizationoftwodevices,specificallyaPCcascadedwithan
IPphone,onasingleportontheB3.TheIPphonemust a uthenticateusingMACor802.1X
authentication,buttheusermayauthentica te
byanymethod.Thisfeatureallowsboththe
user’sPCandIPphonetosimultaneouslyauthenticateonasingleportandeachreceivea
uniquelevelofnetworkaccess.Fordetails,referto“ConfiguringMulti‐UserAuthentication
(User+IPphone)” onpage 20‐30.
•RFC3580TunnelAttributesprovidea
mechanismtocontainan802.1Xauthenticatedusertoa
VLANregardlessofthePVID.UptothreeuserscanbeconfiguredperGigabitport.Referto
“ConfiguringVLANAuthorization(RFC3580)”onpage 20‐41.
•MACLocking–locksaporttooneormoreMACaddresses,preventingtheuseof
unauthorizeddevicesandMACspoofingontheportFordetails,referto“ConfiguringMAC
Locking”onpage 20‐46.
•PortWebAuthentication(PWA)–locksdownaportauserisattached tountilaftertheuser
logsinusingawebbrowsertoaccesstheswitch.Theswitchwillpass
alllogininformation
fromtheendstationtoaRADIUSserverforauthenticationbeforeturningtheporton.PWAis
analternativeto802.1XandMACauthentication.Fordetails,referto“ConfiguringPortWeb
Authentication(PWA)”onpage 20‐57.
•SecureShell(SSH)–providessecureTelnet.Fordetails,referto
“ConfiguringSecureShell
(SSH)”onpage 20‐69.
RADIUS Filter-ID Attribute and Dynamic Policy Profile Assignment
IfyouconfigureanauthenticationmethodthatrequirescommunicationwithaRADIUSserver,
youcanusetheRADIUSFilter‐IDattributetodynamicallyassignapolicyprofileand/or
managementleveltoauthenticatingusersand/ordevices.
TheRADIUSFilter‐IDattributeissimplyastringthatisformattedintheRADIUSAccess‐
Accept
packetsentbackfromtheRADIUSservertotheswitchduringtheauthenticationprocess.
EachusercanbeconfiguredintheRADIUSserverdatabasewithaRADIUSFilter‐IDattribute
thatspecifiesthenameofthepolicyprofileand/ormanagementleveltheusershouldbeassigned
uponsuccessfulauthentication.During
theauthenticationprocess,whentheRADIUSserver
returnsaRADIUSAccess‐AcceptmessagethatincludesaFilter‐IDmatchingapolicyprofilename
Note: To configure EAP pass-through, which allows client authentication packets to be forwarded
through the switch to an upstream device, 802.1X authentication must be globally disabled with the
set dot1x command.
Note: B3 devices support up to eight authenticated users per port.

Table of Contents

Questions and Answers:

Question and Answer IconNeed help?

Do you have a question about the Enterasys SecureStack B3 and is the answer not in the manual?

Enterasys SecureStack B3 Specifications

General IconGeneral
BrandEnterasys
ModelSecureStack B3
CategorySwitch
LanguageEnglish

Related product manuals