3Com 3CR17660-91, Configuration Manual

Page: 169 / 422

Introduction to 802.1x 155
■
The RADIUS server compares the received encrypted password (contained in a
RADIUS access-request packet) with the locally-encrypted password. If the two
match, it will then send feedbacks (through a RADIUS access-accept packet and an
EAP-success packet) to the switch to indicate that the supplicant system is
authorized.
■
The switch changes the state of the corresponding port to accepted state to allow
the supplicant system access the network.
■
The supplicant system can also terminate the authenticated state by sending
EAPoL-Logoff packets to the switch. The switch then changes the port state from
accepted to rejected.
In EAP relay mode, packets are not modified during transmission. Therefore if one of
the three ways are used (that is, PEAP, EAP-TLS, or EAP-MD5) to authenticate, ensure
that the authenticating ways used on the supplicant system and the RADIUS server
are the same. However for the switch, you can simply enable the EAP relay mode by
using the
dot1x authentication-method eap command.
EAP terminating mode
In this mode, packet transmission is terminated at authenticator systems and the EAP
packets are converted to RADIUS packets. Authentication and accounting are
accomplished through RADIUS protocol.
In this mode, PAP or CHAP is employed between the switch and the RADIUS server.
The authentication procedure (assuming that CHAP is employed between the switch
and the RADIUS server) is illustrated in Figure 51.