User Manual

S350 Series 24-Port (PoE+) and 48-Port Gigabit Ethernet Smart Switches
Manage Device Security User Manual243
7. Specify the following settings:
• Port Control. Defines the port authorization state. The control mode is set only if the
link status of the port is link up. Select one of the following options:
- Auto. The switch automatically detects the mode of the interface.
- Authorized. The switch places the interface into an authorized state without
being authenticated. The interface sends and receives normal traffic without client
port-based authentication.
- Unauthorized. The switch denies the selected interface system access by
moving the interface into unauthorized state. The switch cannot provide
authentication services to the client through the interface.
• Host Mode. Defines the host mode for an interface. The host mode determines the
number and types of clients that can be authenticated and authorized on the
interface. The host mode can distinguish between data and voice clients. Select one
of the following options:
- Single-Host. A single data client only can be authenticated and authorized on the
interface before this client is granted access to the interface. Only after the client
logs off, can another client be authenticated and authorized on the interface, and
granted access to the interface.
- Multi-Host. After one data client is authenticated and authorized on the interface,
access is granted to all clients that are connected to the interface.
For example, you can this mode if a WiFi access point is connected to an
access-controlled port of a NAS. After the access point is authenticated by the
NAS, the interface is authorized for traffic of all WiFi clients that are connected to
the access point.
- Multi-Domain. A single voice client and a single data client only can be
authenticated and authorized on the interface before these clients are granted
access to the interface. The voice and data domains are segregated. The
RADIUS server attribute “Cisco-AVPair = ‘device-traffic-class = voice’” is used to
identify a voice client.
For example, you can use this mode if an IP phone is connected to a NAS port
and a laptop is connected to the hub port of the IP phone. Both devices need to
be authenticated to access the network services behind the NAS.
- Multi-Auth. A single voice client and multiple data clients can be authenticated
and authorized on the interface before these clients are granted access to the
interface. The voice and data domains are segregated.
For example, you can use this mode if an IP phone and a network of computers
are connected to a hub that is connected to a NAS port.
- Multi-Domain-Multi-Host. After one voice client and one data client are
authenticated and authorized on the interface, access is granted to all clients that
are connected to the interface, and all these clients are treated as data clients.
The voice and data domains are segregated.