ZyXEL Communications XGS2220 Series - CHAPTER 76 Port Authentication; 76.1 Port Authentication Overview; 76.1.1 What You Can Do

Chapter 76 Port Authentication
XGS2220 Series User’s Guide
518
CHAPTER 76
Port Authentication
76.1 Port Authentication Overview
This chapter describes the IEEE 802.1x, MAC, Guest VLAN, and Compound authentication methods.
• IEEE 802.1x
2
– An authentication server validates access to a port based on a user name and
password provided by the user. A user that fails an authentication server can still access the port, but
traffic from the user is forwarded to the guest VLAN port.
• MAC Authentication – An authentication server validates access to a port based on the MAC address
and password of the client.
• Guest VLAN – In either mode, if authentication fails the Switch can still allow the client to access the
network on a Guest VLAN.
• Compound Authentication – An authentication server validates access to a port based on
combination of IEEE 802.1x and MAC Authentication. There are two modes:
• Loose: The client authenticates using either IEEE 802.1x authentication or MAC Authentication.
• Strict: The client authenticates using both IEEE 802.1x authentication and MAC Authentication.
Note: All types of authentication use the RADIUS (Remote Authentication Dial In User Service,
RFC 2138, 2139) protocol to validate users. You must configure a RADIUS server before
enabling port authentication.
Note: If you enable IEEE 802.1x authentication and MAC authentication on the same port, the
Switch performs IEEE 802.1x authentication and MAC authentication. If a user fails to
authenticate either through the IEEE 802.1x or MAC authentication method, then
access to the port is denied.
Note: IEEE 802.1x is not supported by all user operating systems. For details on compatibility,
see your operating system documentation. If your operating system does not support
802.1x, you must install 802.1x client software.
76.1.1 What You Can Do
• Use the 802.1x screen (Section 76.2 on page 520) to activate IEEE 802.1x security.
• Use the MAC Authentication screen (Section 76.3 on page 521) to activate MAC authentication.
• Use the Guest VLAN screen (Section 76.4 on page 523) to enable and assign a guest VLAN to a port.
2. At the time of writing, IEEE 802.1x is not supported by all operating systems. See your operating system
documentation. If your operating system does not support 802.1x, then you may need to install 802.1x
client software.