FortiGate Administration Guide - FirewallShop.com

Configuring 802.1X authentication
Switch (FortiGate-224B only)
Configuring 802.1X authentication
FortiGate-224B supports device authentication using the IEEE 802.1X standard.
When 802.1X is enabled, no communication, even ARP or DHCP, is permitted
until authentication is successful. Authentication is valid only on one port. If the
device is moved to a different port, it must reauthenticate.
FortiGate-224B unit acts as a proxy between the host 802.1X client, called a
supplicant, and the RADIUS server. When the RADIUS server replies with an
authentication success message, the FortiGate-224B permits the host device to
access the network.
For information about configuring the 802.1X supplicant, refer to the
documentation for the supplicant. For information about configuring the RADIUS
server, refer to the documentation for the RADIUS server.
You must configure the FortiGate-224B unit to access a RADIUS server to
perform authentication before you configure 802.1X authentication. See
“Configuring a RADIUS server” on page 381.
Go to Switch > 802.1X.
Figure 138:802.1X settings
Radius Server
Select the RADIUS authentication server.
If needed, select Create New or go to User > RADIUS to set
up a RADIUS server.
Supplicant Timeout (sec.) Enter the maximum time in seconds that the FortiGate-224B
unit waits for a response from the client. The default is 30
seconds.
Server Timeout (sec.)
Max Re-Authentication
Re-Authentication Period
(sec.)
Enter the maximum time in seconds that the FortiGate-224B
unit waits for a response from the RADIUS server. The
default is 15 seconds.
Enter the maximum number of incomplete authentication
attempts the FortiGate-224B unit permits from one client. The
default is 2. After this number of attempts, the client’s status
is unauthorized.
Enter the time period in seconds after which the client must
reauthenticate. The default is 3600 seconds.
The table shows the authenticated clients.
Port
The switch port to which the client is connected.
MAC Address
The client’s MAC address.
PAE State
Port Access Entity authentication status
BE State
Back End state
Status
Port status: Authorized or Unauthorized
FortiGate Version 3.0 MR5 Administration Guide
226 01-30005-0203-20070830