Users Guide

Authentication, Authorization, and Accounting 321
are segregated into separate VLANs. The RADIUS server attribute vendor
proprietary AVPair device-traffic-class=voice is used to identify the voice
client.
Multi-Domain-Multi-Host Mode
In multi-domain-multi-host mode, one voice device and one data device may
authenticate on a port. However, once the data device is authenticated, access
is authorized on the data VLAN to any connected device.
The typical use case is an IP phone connected to a NAS port and a Virtual
Machine Controller connected to the data port of the IP phone. The Virtual
Machine Controller hosts multiple Virtual Machines. Both the VM
Controller and the IP phone authenticate to access the network services
behind the NAS. The voice and data domains are segregated. Once the VM
Controller is authenticated, it allows traffic from all the VMs hosted by the
VM Controller.
Multi-Auth Mode
In multi-auth mode, one voice client and multiple data hosts can be
authenticated on a port. Each host must authenticate individually. A typical
use case for multi-auth mode is a network of laptops and an IP phone
connected to the NAS port via a hub.
What is MAC Authentication Bypass?
The option to use MAC Authentication Bypass (MAB) is available in all
authentication host modes. MAB is a supplemental authentication
mechanism that allows 802.1X-unaware clients — such as printers, fax
machines, and some IP phones — to authenticate to the network using the
client MAC address as an identifier.
The known and allowable MAC address and corresponding access rights of
the client must be pre-populated in the authentication server. Both MAB
authentication and any of the authentication host modes are supported on a
port simultaneously.
When a port configured for MAB receives traffic from an unauthenticated
client, the switch (Network Authentication Server or NAS):
• Sends a EAP Request packet to the unauthenticated client
• Waits a pre-determined period of time for a response