Skip to main content
dostap
dostap
Visitor III
January 16, 2024
Solved

802.1X-mac-based authentification for multiple device per port

  • January 16, 2024
  • 1 reply
  • 2230 views

I need to do next configuration for two 802.1x devices per single fortiswitch port:

 - ipphone with EAP-MD5 802.1x authentification;

 - PC behind the phone with EAP-TLS certificate based authentification.

As I understand I need configure 802.1X-mac-based authentification on port for this scheme. Shoud it works without keeping all devices mac-address database on RADIUS server?  

Thanks.

Best answer by pminarik

The mac-based vs port-based authorization is a distinction between whether each and every unique MAC address needs to perform 802.1x authentication separately to gain access (mac-based) when connected to this same switch-port, or whether a single device authenticating will authorize the entire switch-port for access, allowing devices with other MAC address to pass traffic through the switch-port. (port-based).

 

MAC-authentication bypass (MAB) is a separate concept, available for both modes, optional.

1 reply

pminarik
Staff
pminarikAnswer
Staff
January 16, 2024

The mac-based vs port-based authorization is a distinction between whether each and every unique MAC address needs to perform 802.1x authentication separately to gain access (mac-based) when connected to this same switch-port, or whether a single device authenticating will authorize the entire switch-port for access, allowing devices with other MAC address to pass traffic through the switch-port. (port-based).

 

MAC-authentication bypass (MAB) is a separate concept, available for both modes, optional.

    dostap
    dostapAuthor
    Visitor III
    January 16, 2024

    Thanks a lot. Now it's clear for me.

    Terms & ConditionsAccessibility statement