Planet GSD-802PS [59/87] X management

User’s Manual of GSD-800S / GSD-802S / GSD-802PS

4.10 802.1X Management

The PLANET Gigabit Ethernet Switch supports IEEE 802.1X Port-base network access control and RADIUS server

authentication to enhance the host link more security. An 802.1X Infrastructure is composed of three major components:

Authenticator, Authentication server, and Supplicant.

Authentication server – (RADIUS Server): An entity that provides an authentication service to an authenticator. This

service determines, from the credentials provided by the supplicant, whether the supplicant is authorized to access the

services provided by the authenticator.

Authenticator-(GSD-800S): An entity at one end of a point-to-point LAN segment that facilitates authentication of the

entity attached to the other end of that link.

Supplicant-(A Host Client): An entity at one end of a point-to-point LAN segment that is being authenticated by an

authenticator attached to the other end of that link.

The instructions are divided into three parts:

The above graph shows the network topology of the solution we are going to introduce. As illustrated, a group of clients is

trying to build a network with Switch in order to have access to both Internet and Intranet. With 802.1X authentication,

each of these clients would have to be authenticated by RADIUS server. If the client is authorized, Switch would be

notified to open up a communication port to be used for the client. There are 2 Extensive Authentication Protocol (EAP)

methods supported: (1) MD5 and (2) TLS.

MD5 authentication is simply a validation of existing user account and password that is stored in a database of RADIUS

server. Therefore, clients will be prompted for account/password validation to build the link. TLS authentication is a more

complicated authentication, which is using certificate that is issued by RADIUS server for authentication. TLS

authentication is a more secure authentication, since not only RADIUS server authenticates the client, but also the client

can validate RADIUS server by the certificate that it issues. The TLS authentication request from clients and reply by

Radius Server and Switch can be briefed as follows:

1. The client sends an EAP start message to Web-Smart Switch.

2. Web-Smart Switch replies with an EAP Request ID message.

3. The client sends its Network Access Identifier (NAI) – its user name – to Web-Smart Switch in an EAP Respond

message.

4. Web-Smart Switch forwards the NAI to the RADIUS server with a RADIUS Access Request message.

5. The RADIUS server responds to the client with its digital certificate.

6. The client validates the digital certificate, and replies its own digital certificate to the RADIUS server.

7. The RADIUS server validates client’s digital certificate.