KSZ9567RTXI datasheet(43/232 Pages) MICROCHIP

43 / 232 page

 2017-2019 Microchip Technology Inc.

DS00002329D-page 43

KSZ9567R

4.4.17

802.1X ACCESS CONTROL

IEEE 802.1X is a Port-based authentication protocol. EAPOL is the protocol normally used by the authentication pro-

cess as uncontrolled Port. By receiving and extracting special EAPOL frames, the host processor can control whether

the ingress and egress ports should forward packets or not. If a user port wants service from another port (authentica-

tor), it must get approved by the authenticator. The device detects EAPOL frames by checking the destination address

of the frame. The destination addresses should be either a multicast address as defined in IEEE 802.1x (01-80-C2-00-

00-03) or an address used in the programmable reserved multicast address domain with offset -00-03. Once EAPOL

frames are detected, the frames are forwarded to the host port so it can send the frames to the authenticator server.

Eventually, the CPU determines whether the requester is qualified or not based on its source MAC address, and frames

are either accepted or dropped.

When the device is configured as an authenticator, the ports of the switch must then be configured for authorization. In

an authenticator-initiated port authorization, a client is powered up or plugs into the port, and the authenticator port

sends an Extensible Authentication Protocol (EAP) PDU to the supplicant requesting the identification of the supplicant.

At this point in the process, the port on the switch is connected from a physical standpoint; however, the 802.1X process

has not authorized the port and no frames are passed from the port on the supplicant into the switching fabric. If the

supplicant attached to the switch (KSZ9567R) did not understand the EAP PDU that it was receiving from the switch, it

would not be able to send an ID and the port would remain unauthorized. In this state, the port would be blocked from

passing any user traffic. If the supplicant is running the 802.1X EAP, it would respond to the request with its configured

ID. (This could be a user name/password combination or a certificate.)

After the device receives the ID from the supplicant, it passes the ID information to an authentication server (RADIUS

server) that can verify the identification information. The RADIUS server responds to the switch with either a success

or failure message. If the response is a success, the port will be authorized and user traffic will be allowed to pass

through the port like any switch port connected to an access device. If the response is a failure, the port will remain

unauthorized and, therefore, unused. If there is no response from the server, the port will also remain unauthorized and

will not pass any traffic.

Port control can be performed via the Access Control List (ACL) Filtering feature.

4.4.18

ACCESS CONTROL LIST (ACL) FILTERING

An Access Control List (ACL) can be created for each port to perform filtering on incoming layer 2 MAC, layer 3 IP or

layer 4 TCP/UDP packets. Multicast filtering is handled in the Static Address Table and the Reserved Multicast Address

Table, but the ACL provides additional capabilities for filtering routed network protocols. As shown in Figure 4-3, ACL

filtering may take precedence over other forwarding functions.

The ACL allows the switch to filter ingress traffic based on the following header fields:

• Source or destination MAC address and/or EtherType

• Source or destination IPv4 address with programmable mask

• IPv4 protocol

• Source or destination UDP port

• Source or destination TCP port

• TCP Flag with programmable mask

The ACL is implemented as an ordered list of up to 16 access control rules which are programmed into the ACL Table.

Each entry specifies certain rules (a set of matching conditions and action rules) to control the forwarding and priority

of packets. When a packet is received on an interface, the switch compares the fields in the packet against any applied

ACLs to verify that the packet has the permissions required to be forwarded, based on the conditions specified in the

lists. Multiple match conditions can be either AND'ed or OR'ed together.

The ACL can also implement a count function that generates an interrupt rather than a forwarding action. The counter

can be either a watchdog timer or an event counter. As a watchdog timer, an interrupt is generated if a packet with a

specific MAC address and EtherType is not received within a specified time interval. As an event counter, an interrupt

is generated once a specified number of packets with a specific MAC address and EtherType have been received.

The ACL consists of three parts: matching rules, action rules, and processing entries. A matching rule specifies what

comparison test shall be performed on the incoming packet. It can also enable a counter function. An action rule spec-

ifies the forwarding action to be taken if the matching test succeeds. Alternatively, when a count function is enabled in

a matching rule, the 11-bit count value is stored in the corresponding action rule field and there is no forwarding action.

In general, the 16 matching rules are not directly linked to the 16 action rules. For example, matching entry #0 is not

necessarily related to action entry #0. The exception is when the counter function is enabled in a matching rule, whereby

the matching rule and action rule fields at the same ACL table entry will function together and are no longer independent.

KSZ9567RTXI 数据表(PDF) 43 Page - Microchip Technology

KSZ9567RTXI 数据表(HTML) 43 Page - Microchip Technology

Html Pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 ...More

数据表下载