RADIUS with Port Identifiers

Zyxel_Claudia

The new firmware update (version 4.90) for Zyxel switches introduces an enhancement for RADIUS authentication by adding port identifiers, specifically the NAS Port ID and Port Type attributes. This update allows administrators to add an additional layer of security to network access control, ensuring that only devices connected to specific ports can access the network.

What is RADIUS with Port Identifiers?

In network security, RADIUS (Remote Authentication Dial-In User Service) is commonly used to authenticate devices and users. Typically, RADIUS verifies user credentials (username and password) or the device’s MAC address. With the new port identifiers in Firmware 4.90, RADIUS authentication can now include port-specific conditions, which strengthens access control and limits unauthorized network access.

Two Key Attributes Added:

1. NAS Port ID: Specifies the exact port on the switch that a client is connected to, ensuring that only devices on designated ports can access the network.
2. Port Type: Defines the type of connection used (e.g., Ethernet), allowing for additional control based on the nature of the connection.

How RADIUS with Port Identifiers Works

When a device, such as a laptop, attempts to connect to a Zyxel switch port, the RADIUS server performs the following checks:

1. Standard Authentication: The server first checks if the username, password, or MAC address matches what is stored on the RADIUS server.
2. Port-Specific Authentication: Using the NAS Port ID, the server verifies if the device is connected to an authorized port.
3. Connection Type Verification: The Port Type is validated to ensure that the device is connecting through the expected type (e.g., Ethernet for switches).

Only if all these conditions are met will the device be granted access to the network.

Benefits of Using Port Identifiers in RADIUS Authentication

1. Enhanced Security:
   • By verifying the NAS Port ID, administrators can restrict access to specific ports, adding an extra security layer.
2. Granular Access Control:
   • Limits network access based on where devices are physically connected, allowing for stricter control of internal network access.
3. Improved Compliance:
   • Meets stringent security policies by ensuring devices connect only through designated ports and specified connection types.

Summary

The RADIUS with Port Identifiers enhancement in Zyxel Firmware 4.90 adds powerful security capabilities for network administrators, allowing them to restrict access based on both the NAS Port ID and Port Type. This feature helps to strengthen internal network security by ensuring that only authorized devices on specific ports can gain access.