3Com Switch 7754, Configuration Manual

Page: 393 / 940

Introduction to 802.1x 393
Figure 92 Data fields
■
The Type field specifies the EAP authentication type. A Type value of 1 indicates
Identity and that the packet is used to query the identity of the peer. A type
value of 4 represents MD5-Challenge (similar to PPP CHAP) and indicates that
the packet includes query information.
■
The Type Date field differs according to different types of Request and
Response packets.
Newly added fields for EAP authentication
Two fields, EAP-message and Message-authenticator, are added to a RADIUS
protocol packet for EAP authentication. (Refer to “Introduction to RADIUS” on
page 508 for format of a RADIUS protocol packet.)
The EAP-message field, shown in Figure 93, is used to encapsulate EAP packets.
The maximum size of the string field is 253 bytes. EAP packets with their size
larger than 253 bytes are fragmented and stored in multiple EAP-message fields.
The type code of the EAP-message field is 79.
Figure 93 The format of an EAP-message field
The Message-authenticator field, as shown in Figure 94, can be used to prevent
interception of access request packets during authentications using CHAP, EAP,
and so on. A packet with the EAP-message field must also have the
Message-authenticator field, otherwise the packet is regarded as invalid and is
discarded.
Figure 94 The format of an Message-authenticator field
802.1x Authentication
Procedure
A 3Com 6500 series switch can authenticate supplicant systems in EAP
terminating mode or EAP relay mode.
EAP relay mode
This mode is defined in 802.1x. In this mode, EAP-packets are encapsulated in
higher level protocol (such as EAPoR) packets to allow them successfully reach the
authentication server. This mode normally requires the RADIUS server to support
the two newly-added fields: the EAP-message field (with a value of 79) and the
Message-authenticator field (with a value of 80).
0 N
Type Type data
7
0 15
Type String
7
Length
N
EAP packets
0 2
Type String
1
Length
18 bytes