Filter
Top Products
User’s Manual of GSD-800S / GSD-802S / GSD-802PS
4.10 802.1X Management
The PLANET Gigabit Ethernet Switch supports IEEE 802.1X Port-base network access control and RADIUS server
authentication to enhance the host link more security. An 802.1X Infrastructure is composed of three major components:
Authenticator, Authentication server, and Supplicant.
Authentication server – (RADIUS Server): An entity that provides an authentication service to an authenticator. This
service determines, from the credentials provided by the supplicant, whether the supplicant is authorized to access the
services provided by the authenticator.
Authenticator-(GSD-800S): An entity at one end of a point-to-point LAN segment that facilitates authentication of the
entity attached to the other end of that link.
Supplicant-(A Host Client): An entity at one end of a point-to-point LAN segment that is being authenticated by an
authenticator attached to the other end of that link.
The instructions are divided into three parts:
The above graph shows the network topology of the solution we are going to introduce. As illustrated, a group of clients is
trying to build a network with Switch in order to have access to both Internet and Intranet. With 802.1X authentication,
each of these clients would have to be authenticated by RADIUS server. If the client is authorized, Switch would be
notified to open up a communication port to be used for the client. There are 2 Extensive Authentication Protocol (EAP)
methods supported: (1) MD5 and (2) TLS.
MD5 authentication is simply a validation of existing user account and password that is stored in a database of RADIUS
server. Therefore, clients will be prompted for account/password validation to build the link. TLS authentication is a more
complicated authentication, which is using certificate that is issued by RADIUS server for authentication. TLS
authentication is a more secure authentication, since not only RADIUS server authenticates the client, but also the client
can validate RADIUS server by the certificate that it issues. The TLS authentication request from clients and reply by
Radius Server and Switch can be briefed as follows:
1. The client sends an EAP start message to Web-Smart Switch.
2. Web-Smart Switch replies with an EAP Request ID message.
3. The client sends its Network Access Identifier (NAI) – its user name – to Web-Smart Switch in an EAP Respond
message.
4. Web-Smart Switch forwards the NAI to the RADIUS server with a RADIUS Access Request message.
5. The RADIUS server responds to the client with its digital certificate.
6. The client validates the digital certificate, and replies its own digital certificate to the RADIUS server.
7. The RADIUS server validates client’s digital certificate.