3Com Switch 7757, Configuration Manual

Page: 389 / 940

39
802.1
X
C
ONFIGURATION
Introduction to 802.1x
The 802.1x protocol (802.1x for short) was developed by IEEE802 LAN/WAN
committee to address security issues of wireless LANs. It was then used in Ethernet
as a common access control mechanism for LAN ports to address mainly
authentication and security problems.
802.1x is a port-based network access control protocol. It authenticates and
controls devices requesting for access in terms of the ports of LAN access control
devices. With the 802.1x protocol employed, a user-side device can access the LAN
only when it passes the authentication. Those failing to pass the authentication
are denied when accessing the LAN, as if they are disconnected from the LAN.
Architecture of 802.1x
Authentication
802.1x adopts a client/server architecture with three entities: a supplicant system,
an authenticator system, and an authentication server system, as shown in
Figure 88.
Figure 88 Architecture of 802.1x authentication
■
The supplicant system is an entity residing at one end of the LAN segment and
is authenticated by the authenticator system connected to the other end of the
LAN segment. The supplicant system is usually a user terminal device. An
802.1x authentication is initiated when a user launches client program on the
supplicant system. Note that the client program must support the EAPoL
(extensible authentication protocol over LANs).
■
The authenticator system authenticates the supplicant system. The
authenticator system is usually an 802.1x-supported network device (such as a
3Com series switch). It provides the port (physical or logical) for the supplicant
system to access the LAN.
■
The authentication server system is an entity that provides authentication
service to the authenticator system. Normally in the form of a RADIUS server,
Supplicant PAE
Supplicant system
Services offered by
authenticator ÿ s
system
Authenticator
PAE
Authenticator system
Authentication
server system
Authentication
server
EAP protocol
exchanges
carried in
higher layer
protocol
Port
unauthorized
LAN/ WLAN