How to enable 802.1x authentication on Dell Networking Force10 switches


How to enable 802.1x authentication on Dell Networking Force10 switches


This article explains how to enable 802.1x authentication on Dell Networking Force10 switches.


Objectives
  1. What is 802.1x?
  2. Important things to remember
  3. Enable 802.1x
  4. Set up RADIUS Server connection
  5. Verify configuration


What is 802.1x?

802.1X is a method of port security. A device connected to a port that is enabled with 802.1X is disallowed from sending or receiving packets on the network until its identity can be verified (through a username and password, for example). This feature is named for its IEEE specification.

802.1X employs extensible authentication protocol (EAP) to transfer a device’s credentials to an authentication server (typically RADIUS) using a mandatory intermediary network access device, in this case, a Dell Networking switch. The network access device mediates all communication between the end-user device and the authentication server so that the network remains secure. The network access device uses EAP-over-Ethernet (EAPOL) to communicate with the end-user device and EAP-over-RADIUS to communicate with the server.

The Dell Networking Operating System (OS) supports 802.1X with EAP-MD5, EAP-OTP, EAP-TLS, EAP-TTLS, PEAPv0, PEAPv1, and MS-CHAPv2 with PEAP.


Important Things to Remember

  • Dell Networking OS supports 802.1X with EAP-MD5, EAP-OTP, EAP-TLS, EAP-TTLS, PEAPv0, PEAPv1, and MS-CHAPv2 with PEAP.
  • All platforms support only RADIUS as the authentication server.
  • If the primary RADIUS server becomes unresponsive, the authenticator begins using a secondary RADIUS server, if configured.
  • 802.1X is not supported on port-channels or port-channel members.


Enable 802.1x

Command Parameters
FTOS# configure Enter configuration mode.
FTOS(conf)# dot1x authentication Globally enable dot1x authentication
FTOS(conf)# interface range te 1/1 – 2 Enter a specific range of ports to be configured.
FTOS(conf-if-te-1/1-2)# switchport Enable Layer 2 switchport mode on the interface.
FTOS(conf-if-te-1/1-2)# dot1x authentication Enable dot1x authentication on the port level for the specified range.

Set up RADIUS Server Connection


Command Parameters
FTOS# configure Enter configuration mode.
FTOS(conf)#radius-server host 10.180.58.10 Set IP address or host name that points to the RADIUS server location.
FTOS(conf)#radius-server key {encryption-type} key Set the RADIUS server key for handshake with RADIUS server.
encryption-type options are:
0 Specify an UNENCRYPTED key will follow
7 Specify a HIDDEN key will follow
LINE The UNENCRYPTED (cleartext) user key (max 42 chars)
FTOS(conf)#dot1x auth-server radius Identify the dot1x authentication server as a RADIUS server.

Verify 802.1x configuration

The following commands will show the 802.1x configured on the switch.
FTOS#show running-config | find dot1x
dot1x authentication
!
[output omitted]
!
interface TenGigabitEthernet 1/1
no ip address
dot1x authentication
no shutdown

FTOS#show dot1x interface TenGigabitEthernet 1/1
802.1x information on Te 1/1
:-----------------------------
Dot1x Status: Enable
Port Control: AUTO
Port Auth Status: UNAUTHORIZED
Re-Authentication: Disable
Untagged VLAN id: None
Guest VLAN: Disable
Guest VLAN id: NON
EAuth-Fail VLAN: Disable
Auth-Fail VLAN id: NONE
Auth-Fail Max-Attempts: NONE
Mac-Auth-Bypass: Disable
Mac-Auth-Bypass Only: Disable
Tx Period: 30 seconds
Quiet Period: 60 seconds
ReAuth Max: 2
Supplicant Timeout: 30 seconds
Server Timeout: 30 seconds
Re-Auth Interval: 3600 seconds
Max-EAP-Req: 2
Host Mode: SINGLE_HOST
Auth PAE State: Initialize
Backend State: Initialize

FTOS#show run | grep radius|dot1x

dot1x authentication
dot1x authentication
radius-server host 10.180.58.10 key 7 7bb92471cb453a73







Article ID: HOW10775

Last Date Modified: 09/14/2019 01:25 AM

Rate this article

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\
characters left.