Administrator Guide

Security Commands 966
802.1x Commands
Dell Networking N1500/N2000/N3000/N4000 Series Switches
Local Area Networks (LANs) are often deployed in environments that permit
the attachment of unauthorized devices. The networks also permit
unauthorized users to attempt to access the LAN through existing
equipment. In such environments, the administrator may desire to restrict
access to the services offered by the LAN.
Port-based network access control makes use of the physical characteristics of
LAN infrastructures to provide a means of authenticating and authorizing
devices attached to a LAN port. Port-based network access control prevents
access to the port in cases in which the authentication and authorization
process fails. A port is defined as a single point of attachment to the LAN.
The Dell Networking switches support an 802.1x Authenticator service with a
local authentication server or authentication using remote RADIUS or
TACACS servers. Refer to "AAA Commands" on page 854 for information on
configuring connectivity to a RADIUS or TACACS authentication server or
to configure the local authentication service.
Dell Networking switches also support 802.1X accounting to RADIUS or
TACACS servers. Refer to the "AAA Commands" section to configure 802.1X
accounting.
MD5 or none is the supported authentication method for communication
with an authentication server. Dell Networking does not support encryption
of switch initiated authenticator/authentication server communication.
However, Dell Networking switches are capable of transporting end-to-end
encrypted traffic such as EAP-TLS between a supplicant and an authenticator.
802.1x Monitor Mode
Monitor mode is a special mode that can be enabled in conjunction with
Dot1x authentication. It allows network access even in case where there is a
failure to authenticate but logs the results of the authentication process for
diagnostic purposes. The exact details are described in the below sections.
The main aim of the monitor mode is to provide a mechanism to the operator
to be able to identify the short-comings in the configuration of a 802.1x
authentication on the switch without affecting the network access to the
users of the switch.
2CSNXXX_SWUM204.book Page 966 Monday, January 25, 2016 1:25 PM