Allied Telesis AT-S63 User Manual

Page 735

Advertising
background image

AT-S63 Management Software Menus Interface User’s Guide

Section VII: Port Security

735

ˆ

An authenticator port cannot be part of a static port trunk, LACP port
trunk, or port mirror.

ˆ

If a switch port set to the supplicant role is connected to a port on
another switch that is not set to the authenticator role, the port, after a
timeout period, assumes that it can send traffic without having to log
on.

ˆ

GVRP must be disabled on an authenticator port.

ˆ

When 802.1x Port-based Network Access Control is activated on a
switch, the feature polls all RADIUS servers specified in the RADIUS
configuration. If three servers have been configured, the switch polls
all three. If server 1 responds, all future requests go only to that server.
If server 1 stops responding, the switch again polls all RADIUS
servers. If server 2 responds, but not server 1, then all future requests
go to servers 1 and 2. If only server 3 responds, then all future
requests go to all three servers.

ˆ

In order to change the untagged VLAN assignment of an authenticator
or supplicant port, you must first set its port role to none. After the
VLAN assignment is made, you can change the port’s role back again
to authenticator or supplicant, if needed.

ˆ

A Guest VLAN can be either port-based or tagged.

ˆ

To use the Guest VLAN feature, the designated VLAN must already
exist on the switch.

ˆ

The switch must be running in the user-configured VLAN mode to
support 802.1x port-based network access control. The feature is not
supported when the switch is running in a multiple VLAN mode. For
further information, refer to “Selecting a VLAN Mode” on page 666.

ˆ

The AT-S63 management software only supports EAP-MD5
authentication for both authenticators and supplicants.

Here are guidelines that apply when adding VLAN assignments to
supplicant accounts on a RADIUS server:

ˆ

The VLAN can be either port-based or tagged.

ˆ

The VLAN must already exist on the switch.

ˆ

A client can have only one VLAN associated with it on the RADIUS
server.

ˆ

When a supplicant logs on, the switch port is moved as an untagged
port to the designated VLAN.

Advertising