Netgear 700 Series Managed Switch for Software v2.1 User Manual download pdf (Page 137)

700 Series Managed Switch User’s Guide for Software v2.1

802.1x Port-Based Authentication Overview C-3

SM-10004-02

Initial 802.1x communications begin with an unauthenticated supplicant (i.e., client device)

attempting to connect with an authenticator (i.e., 802.11 access point). The access point responds

by enabling a port for passing only EAP packets from the client to an authentication server located

on the wired side of the access point. The access point blocks all other traffic, such as HTTP,

DHCP, and POP3 packets, until the access point can verify the client's identity using an

authentication server (e.g., RADIUS). Once authenticated, the access point opens the client's port

for other types of traffic.

The basic 802.1x protocol provides effective authentication and can offering dynamic key

management using 802.1x as a delivery mechanism. If configured to implement dynamic key

exchange, the 802.1x authentication server can return session keys to the access point along with

the accept message. The access point uses the session keys to build, sign and encrypt an EAP key

message that is sent to the client immediately after sending the success message. The client can

then use contents of the key message to define applicable encryption keys. In typical 802.1x

implementations, the client can automatically change encryption keys as often as necessary to

minimize the possibility of eavesdroppers having enough time to crack the key in current use.

It's important to note that 802.1x doesn't provide the actual authentication mechanisms. When

using 802.1x, you need to choose an EAP type, such as Transport Layer Security (EAP-TLS) or

EAP Tunneled Transport Layer Security (EAP-TTLS), which defines how the authentication takes

place.

The important part to know at this point is that the software supporting the specific EAP type

resides on the authentication server and within the operating system or application software on the

client devices. The 700 Series Managed Switch acts as a “pass through” for 802.1x messages. As a

result, you can update the EAP authentication type as newer types become available and your

requirements for security change.

1 2 ... 132 133 134 135 136 137 138 139 140 141 142 ... 151 152

No comments

Netgear 700 Series Managed Switch for Software v2.1 User Manual Page 137