IEEE802.1X is a standard that provides an authentication method for port access.
Local Area Networks (LANs) are often deployed in environments that permit unauthorized devices to be physically attached to the LAN infrastructure or permit unauthorized users to access the LAN through equipment that is already attached to the LAN. In such environments, you might want to restrict access to LAN services to authorized users and devices.
Access control for a port-based network uses the physical characteristics of the LAN infrastructure to authenticate and authorize devices that are attached to a LAN port. In this context, a LAN port is a single point of attachment to the LAN, such as a port of a bridge and associations between stations or access points in a wireless LAN.
The IEEE 802.1X standard requires a protocol between the supplicant (that is, the system that requests authentication) and the authenticator (that is, the system that passes the authentication request to the authentication server), as well as between the authenticator and the authentication server.
The smart switch supports a guest VLAN, which allows unauthenticated users limited access to network resources.
A port access entity (PAE) can adopt one of two distinct roles within an access control interaction:
- Authenticator. A port that enforces authentication before allowing access to services available through that port.
- Supplicant. A port that attempts to access services offered by the authenticator.
In addition, a third role exists, authentication server, which is a server that authenticates the supplicant on behalf of the authenticator.
All three roles are required for an authentication exchange to be completed.
A smart switch supports the authenticator role only, in which the PAE is responsible for communicating with the supplicant. The authenticator PAE also submits the information that it receives from the supplicant to the authentication server. Depending on the outcome of the RADIUS-based authentication process, the authenticator PAE sets the state of the port to authorized or unauthorized.
For information about configuring 802.1X-based authentication on a smart switch, see the "How do I configure 802.1X-based authentication on a smart switch?