How 802.1X host authentication works for multiple clients

When multiple hosts are connected to a single 802.1X-enabled port on a RUCKUS device, 802.1X authentication is performed in the following way.
  1. One of the 802.1X-enabled clients attempts to log in to a network in which a RUCKUS device serves as an authenticator.
  2. The RUCKUS device creates an internal session (called a dot1x-mac-session) for the client. A dot1x-mac-session serves to associate a client MAC address and username with its authentication status. Users trying to gain access from different clients (with different MAC addresses) need to be authenticated from each client.
  3. The RUCKUS device performs 802.1X authentication for the client. Messages are exchanged between the RUCKUS device and the client, and between the device and the authentication server (RADIUS server). The result of this process is that the client is either successfully authenticated or not authenticated, based on the username and password supplied by the client.
  4. If the client is successfully authenticated, the client dot1x-mac-session is set to "access-is-allowed". This means that traffic from the client can be forwarded normally.
  5. If authentication for the client is unsuccessful, an authentication failure action is taken. The authentication failure action can be either to drop traffic from the client, or to place the port in a restricted VLAN:
    • If the authentication failure action is to drop traffic from the client, then the client dot1x-mac-session is set to "access-denied", causing traffic from the client to be dropped in hardware.
    • If the authentication failure action is to place the port in a restricted VLAN, the client dot1x-session is set to "access-restricted". The port is moved to the specified restricted VLAN, and traffic from the client is forwarded normally.
  6. When the client disconnects from the network, the RUCKUS device deletes the client dot1x-mac-session. This does not affect the dot1x-mac-session or authentication status (if any) of the other hosts connected on the port.
  7. If a client has been denied access to the network (that is, the client dot1x-mac-session is set to "access-denied"), then you can reauthenticate the client manually by disconnecting the client from the network, or by using the clear dot1x sessions command.
Note: Dynamic IP ACL and MAC address filter assignment is supported in an 802.1X multiple-host configuration. Refer to Dynamic IP ACLs and MAC address filters in flexible authentication.
Parent topic: 802.1X Authentication