3.2 Port Security

Port Security

Controlling access on individual switch interfaces or wireless access points.

• A common example is when connecting to a network requires a username and password

• Over the years, many authentication methods have been developed, giving network administrators various options for enforcing security.

• Often associated with wireless networks but also be applied to wired connections on traditional switches

Extensible Authentication Protocol (EAP)

A framework used to enable port security across various network types.

• Supports multiple authentication methods based on RFC standards, allowing flexibility for manufacturers to implement it on both wireless access points and wired switches.

• Most commonly used with the 802.1X standard, which handles user and device authentication before granting network access

IEEE 802.1X

Prevents unauthorized devices from accessing a network through a switch port or wireless access point

• Also known as Port-based Network Access Control (NAC)

• When a device connects, it must first authenticate using this before gaining any network access.

• Works with EAP to handle the login process and is often integrated with authentication servers or databases like RADIUS, LDAP, TACACS+, or Kerberos to verify user credentials.

IEEE 802.1X & EAP Example

Involves three components:

• The supplicant (the client device)

• The authenticator (the switch or access point

• The authentication server (which checks login credentials).

  
  

When the supplicant connects, it’s initially blocked from network access until it authenticates.

The authenticator sends an EAP request to the supplicant, asking for login info. The supplicant responds with an EAP message containing its identity.

This is forwarded to the authentication server, which asks for more credentials. The authenticator relays this request, and the supplicant sends its login details.

If the credentials match, the authentication server sends a success message to the authenticator, which then allows the supplicant access to the network.