Port Authentication

Optical LAN ONTs support 802.1x port-based access control via a Remote Access Dial-In User Service (RADIUS) server in the management network. This allows the network provider to authenticate the customer premises equipment (CPE) on a subscriber port before allowing traffic between the subscriber and the network. 

In addition, several Dynamic Authorization Client IPs and hostnames representing DAC servers are allowed (4 DAC servers) in the Port Authentication configuration dialog if the Change of Authorization (CoA) option is utilized in the Ethernet Port Profile using the RADIUS tab. 

Use the following procedure to enable 802.1x port-based control for Ethernet Line Port(s), and to, alternately, specify RADIUS server(s):

1. Click the Port Authentication button to display the Port Authentication screen.
   
   
2. In the Port Authentication dialog, check the Enable 802.1X port-based access control check box to enable 802.1X processing for Ethernet Line ports on this ONT.
3. If RADIUS Authentication is also to be utilized, enter the RADIUS Server IP Address, Shared Key, and repeat the Shared Key in the Confirm Key field for up to four RADIUS servers.
4. Click on the Set for Standard button for default values.
5. The Actions button allows the user to view password text for the Shared key for both the RADIUS server and DAC server, as follows:

• The Shared Key is the shared secret key that both the OLT and the RADIUS server use for authentication.
• Shared Key entries don’t have to be unique.
• For each RADIUS server, the Shared Key and Confirm Key entries must match.

6. If the Dynamic Authorization Client Hostname and IP Address are utilized, enter the hostname or IP address in the field for each DAC server.
   • For each DAC server, the Shared Key and Confirm Key entries must match. Up to 4 DAC servers are allowed.
7. When finished, click Apply then click Close.