Filter
Top Products
Chapter 31: 802.1x Port-based Network Access Control
376 Section VIII: Port Security
An authenticator port cannot be part of a static port trunk, LACP port
trunk, or port mirror.
If a switch port set to the supplicant role is connected to a port on
another switch that is not set to the authenticator role, the port, after a
timeout period, assumes that it can send traffic without having to log
on.
GVRP must be disabled on an authenticator port.
When 802.1x port-based network access control is activated on a
switch, the feature polls all RADIUS servers specified in the RADIUS
configuration. If three servers have been configured, the switch polls
all three. If server 1 responds, all future requests go only to that server.
If server 1 stops responding, the switch again polls all RADIUS
servers. If server 2 responds, but not server 1, then all future requests
go to servers 1 and 2. If only server 3 responds, then all future
requests go to all three servers.
In order to change the untagged VLAN assignment of an authenticator
or supplicant port, you must set its port role to none. You can change
the port’s role back to authenticator or supplicant after you have
changed the port’s VLAN assignment.
To use the Guest VLAN feature, the designated VLAN must already
exist on the switch.
A Guest VLAN can be either port-based or tagged.
The switch must be running in the user-configured VLAN mode to
support 802.1x port-based network access control. The feature is not
supported in the multiple VLAN modes.
Starting with version 3.0.0, the AT-S63 Management Software
supports EAP-MD5, EAP-TLS, EAP-TTLS, and EAP-PEAP
authentication for both authenticators and supplicants. Prior to version
3.0.0, only EAP-MD5.was supported.
The switch must have a routing interface on the local subnet where the
RADIUS server is a member. The switch uses the routing interface’s IP
address as its source address when communicating with the server.
For background information, refer to “Routing Interfaces and
Management Features” on page 318.
Note
Prior to version 2.0.0 of the AT-S63 Management Software, the
RADIUS server had to be a member of the switch’s management
VLAN. This restriction no longer applies. The server can be located
on any local subnet on the switch that has a routing interface.