LevelOne GSW-4876 - Manual (Page 89)

C HAPTER 4 | Configuring the Switch
Configuring Security
– 89 –
these encryption methods in Windows 95 and 98, you can use the
AEGIS dot1x client or other comparable client software.)
MAC-based authentication allows for authentication of more than one user
on the same port, and does not require the user to have special 802.1X
software installed on his system. The switch uses the client's MAC address
to authenticate against the backend server. However, note that intruders
can create counterfeit MAC addresses, which makes MAC-based
authentication less secure than 802.1X authentication.
P ATH
Advanced Configuration, Security, Network, NAS
U SAGE G UIDELINES
When 802.1X is enabled, you need to configure the parameters for the
authentication process that runs between the client and the switch (i.e.,
authenticator), as well as the client identity lookup process that runs
between the switch and authentication server. These parameters are
described in this section.
P ARAMETERS
These parameters are displayed:
System Configuration
◆ Mode - Indicates if 802.1X and MAC-based authentication are globally
enabled or disabled on the switch. If globally disabled, all ports are
allowed to forward frames.
◆ Reauthentication Enabled - Sets clients to be re-authenticated after
an interval specified by the Re-authentication Period. Re-authentication
can be used to detect if a new device is plugged into a switch port.
(Default: Disabled)
For MAC-based ports, reauthentication is only useful if the RADIUS
server configuration has changed. It does not involve communication
between the switch and the client, and therefore does not imply that a
client is still present on a port (see Age Period below).
◆ Reauthentication Period - Sets the time period after which a
connected client must be re-authenticated. (Range: 1-3600 seconds;
Default: 3600 seconds)
◆ EAPOL Timeout - Sets the time the switch waits for a supplicant
response during an authentication session before retransmitting a
Request Identify EAPOL packet. (Range: 1-255 seconds; Default: 30
seconds)
◆ Aging Period - The period used to calculate when to age out a client
allowed access to the switch through Single 802.1X, Multi 802.1X, and
MAC-based authentication as described below. (Range: 10-1000000
seconds; Default: 300 seconds)
When the NAS module uses the Port Security module to secure MAC
addresses, the Port Security module needs to check for activity on the