[Contents] [Prev] [Next] [Index] [Report an Error]

Overview of IEEE 802.1x Port-Based Network Access Control

MX-series platforms support the IEEE 802.1x Port-Based Network Access Control (dot1x) protocol on Ethernet interfaces for validation of client and user credentials to prevent unauthorized access to a specified router port. Before authentication is complete, only 802.1x control packets are allowed and forwarded to the router control plane for processing. All other packets are dropped.

Authentication methods used must be 802.1x compliant. Authentication using RADIUS and Microsoft Active Directory servers is supported. The following user/client authentication methods are allowed:

EAP-MD5 (RFC 3748)
EAP-TTLS Requires client and server certificates (RFC 2716)
EAP-TLS Requires only server certificate
PEAP Requires only server certificate

Note: On the MX–series platform, 802.1x can be enabled on bridged ports only and not on routed ports.

Dynamic changes to a user session are supported to allow the router administrator to terminate an already authenticated session by using the “RADIUS disconnect” message defined in RFC 3576.

[Contents] [Prev] [Next] [Index] [Report an Error]