User manual

C HAPTER 14 | Security Measures
Configuring 802.1X Port Authentication
– 196 –
ES-2000 Series
CONFIGURING PORT
SUPPLICANT SETTINGS
FOR 802.1X
Use the Security > Port Authentication (Configure Interface – Supplicant)
page to configure 802.1X port settings for supplicant requests issued from
a port to an authenticator on another device. When 802.1X is enabled and
the control mode is set to Force-Authorized (see "Configuring Port
Authenticator Settings for 802.1X" on page 192), you need to configure
the parameters for the client supplicant process if the client must be
authenticated through another device in the network.
COMMAND USAGE
◆ When devices attached to a port must submit requests to another
authenticator on the network, configure the Identity Profile parameters
on the Configure Global page (see "Configuring 802.1X Global Settings"
on page 191) which identify this switch as a supplicant, and configure
the supplicant parameters for those ports which must authenticate
clients through the remote authenticator on this configuration page.
When PAE supplicant mode is enabled on a port, it will not respond to
dot1x messages meant for an authenticator.
◆ This switch can be configured to serve as the authenticator on selected
ports by setting the Control Mode to Auto on the Authenticator
configuration page, and as a supplicant on other ports by the setting
the control mode to Force-Authorized on that configuration page and
enabling the PAE supplicant on the Supplicant configuration page.
PARAMETERS
These parameters are displayed:
◆ Port – Port number.
◆ PAE Supplicant – Enables PAE supplicant mode. (Default: Disabled)
If the attached client must be authenticated through another device in
the network, supplicant status must be enabled.
Supplicant status can only be enabled if PAE Control Mode is set to
“Force-Authorized” on this port (see "Configuring Port Authenticator
Settings for 802.1X" on page 192).
PAE supplicant status cannot be enabled if a port is a member of trunk
or LACP is enabled on the port.
◆ Authentication Period – The time that a supplicant port waits for a
response from the authenticator. (Range: 1-65535 seconds;
Default: 30 seconds)
◆ Hold Period – The time that a supplicant port waits before resending
its credentials to find a new an authenticator. (Range: 1-65535
seconds; Default: 30 seconds)
◆ Start Period – The time that a supplicant port waits before resending
an EAPOL start frame to the authenticator. (Range: 1-65535 seconds;
Default: 30 seconds)