Port Authentication Entity (PAE)
Port Authentication Entity (PAE) profiles assign attributes to OLTs, GPON cards, and GPON ports. The user is able to, to create, edit, or delete PAE profiles and view the current status of the PAE profile.
PAE allows the operation of a system’s port(s) to be controlled to ensure that access to its services is permitted only by systems that are authorized to do so.
PAE provides a means of preventing unauthorized access by supplicants or users to the services offered by a system. Control over the access to a switch and the LAN to which it is connected can be desirable in order to restrict access to publicly accessible bridge ports or departmental LANs.
A PAE (Port Access Entity) can adopt one of two roles within an access control interaction:
- Authenticator - Port that enforces authentication before allowing access to services available via that Port.
- Supplicant - Port that attempts to access services offered by the Authenticator.
Additionally, there exists a third role:
- Authentication server - Server that performs the authentication function necessary to check the credentials of the supplicant on behalf of the Authenticator.
Completion of an authentication exchange requires all three roles. The authenticator PAE is also responsible for submitting information received from the supplicant to the authentication server in order for the credentials to be checked, which determines the authorization state of the port. Depending on the outcome of the authentication process, the authenticator PAE then controls the authorized/unauthorized state of the controlled Port.
Authentication can be handled locally or via an external authentication server Such as Remote Authentication Dial-In User Service (RADIUS).
PAE Example
- Client - The workstation that requests access to the LAN and responds to requests from the switch.
- Authenticator - Controls physical access to the network based on the authentication status of the client. The switch acts as an intermediary between the client and the authentication server, requesting identity information from the client, verifying that information with the authentication server, and relaying a response to the client. The switch encapsulates and decapsulates the Extensible Authentication Protocol (EAP) frames and interacts with the RADIUS authentication server.
When the switch receives EAPOL frames and relays them to the authentication server, the Ethernet header is stripped, and the remaining EAP frame is re-encapsulated in the RADIUS format. The EAP frames are not modified or examined during encapsulation, and the authentication server must support EAP within the native frame format. When the switch receives frames from the authentication server, the frame header is removed from the server, leaving the EAP frame, which is then encapsulated for Ethernet and sent to the client.
- Authentication server - Performs the actual authentication of the client. The authentication server validates the identity of the client and notifies the switch that the client is authorized to access the LAN and switch services.
Default Profile
Panorama PON initially creates one default PAE profile. This profile is assigned to all GPON ports on an OLT when they are initially provisioned.
The default profile can be edited but not deleted. New profiles can be defined and used as needed, the default profile does not have to be used.
However, lines that are associated with a non-default profile are automatically activated. Because a profile can be associated with multiple lines at once, this is the most efficient way to activate lines.
- To access PAE right-click on the profiles (
) icon on the Main Window Toolbar.
- For PAE related procedures, refer below:
| Next