3Com 5500 SI - Switch - Stackable, Configuration Manual

Page: 392 / 686

392 C
HAPTER
21: 802.1
X
C
ONFIGURATION
Authenticator and Authentication Server exchange information through EAP
(Extensible Authentication Protocol) frames. The user and the Authenticator exchange
information through the EAPoL (Extensible Authentication Protocol over LANs) frame
defined by IEEE 802.1x. Authentication data are encapsulated in the EAP frame,
which is to be encapsulated in the packets of other AAA upper layer protocols (for
example, RADIUS) so as to go through the complicated network to reach the
Authentication Server. Such procedure is called EAP Relay.
There are two types of ports for the Authenticator. One is the Uncontrolled Port, and
the other is the Controlled Port. The Uncontrolled Port is always in bi-directional
connection state. The user can access and share the network resources any time
through the ports. The Controlled Port will be in connecting state only after the user
passes the authentication. Then the user is allowed to access the network resources.
Figure 104 802.1x System Architecture
802.1x Authentication
Process
802.1x configures EAP frame to carry the authentication information. The Standard
defines the following types of EAP frames:
■
EAP-Packet: Authentication information frame, used to carry the authentication
information.
■
EAPoL-Start: Authentication originating frame, actively originated by the user.
■
EAPoL-Logoff: Logoff request frame, actively terminating the authenticated state.
■
EAPoL-Key: Key information frame, supporting to encrypt the EAP packets.
■
EAPoL-Encapsulated-ASF-Alert: Supports the Alerting message of Alert Standard
Forum (ASF).
The EAPoL-Start, EAPoL-Logoff and EAPoL-Key only exist between the user and the
Authenticator. The EAP-Packet information is re-encapsulated by the Authenticator
System and then transmitted to the Authentication Server System. The
EAPoL-Encapsulated-ASF-Alert is related to the network management information
and terminated by the Authenticator.
Although 802.1x provides user ID authentication, 802.1x itself is not enough to
implement the scheme. The administrator of the access device should configure the
AAA scheme by selecting RADIUS or local authentication to assist 802.1x to
implement the user ID authentication. For detailed description of AAA, refer to the
corresponding AAA configuration.
Supplicant
Authenticator
PAE
Authenticat
Server
Supplicant
System
Authenticator System
Authenticato
Server
System
EAP protocol
exchanges
carried in
higher layer
protocol
EAPoL
Controlled
Port
Port
unauthorized
LAN
Uncontrolled
Port
Services
offered
by
Authenticators
System
(User)