TCP/IP Tutorial and Technical Overview - IBM Redbooks

Edge authentication
The IEEE 802.1x standard suggests deploying 802.1x on edge switches closest
to the device needing access to computing resources, as depicted in Figure 23-5
on page 896. This approach creates the following advantages:
► Security
All authenticated end states on the local access bridge are protected from
non-authenticated end stations. If authentication was performed on a core
bridge, it is possible for a malicious end station to attack authenticated end
stations connected to the same local access bridge, or any number of other
local access bridges between this bridge and the core bridge. These attacks
are eliminated by limiting service to non-authenticated end stations directly on
the local access bridge.
► Complexity
If authentication is performed in the core of the LAN, there is the possibility of
multiple bridges on a shared segment initiating authentication. To avoid this,
the bridge protocol entity must manipulate the spanning tree states to make
sure that only the bridge that lies in the forwarding path initiates
authentication.
► Scalability
Implementing authentication in the core of the LAN requires authentication to
depend on individual MAC addresses, not just on a physical point of
attachment. This, in turn, requires that the authentication state be associated
with the filtering database entry for that MAC address. This increases the
implementation costs and requires changes to the operation of address aging
and learning. Topology changes and spanning tree reconfigureation
complicate the interaction in a large network.
► Availability
Bridged networks are frequently designed with availability as one of the
primary goals. The core of the network is redundant fault-tolerant. If
authentication is performed in the core, it requires reauthentication of all the
end stations whenever topology changes cause port state changes in the
spanning tree.
► Translational bridging
Performing authentication at the access bridge avoids complications arising
from translational bridging or VLANS. If only a single link exists between the
end station and the bridge, frames do not need to be translated or tagged
during the authentication exchange. The path to a core bridge might involve a
variety of link types (FDDI, token ring, and so on) and packet formats (for
example, VLAN tagged frames, MAC encapsulations). Were authentication to
be allowed on core bridges, additional rules might be necessary in order to
specify how the authentication protocols are translated.
Chapter 23. Port based network access control 905