MNS-BB
Software User Guide
-107-
21.3 Protocol
Operation
Communication between a supplicant and authenticator is via EAPOL (EAP over LAN).
Authenticator and authentication server communicate using EAP over RADIUS. The ff. illustrations
show the protocol involved between 802.1x entities.
Figure 2. 802.1x Protocol
EAP, short for Extensible Authentication Protocol, is an authentication framework which supports
multiple authentication methods. EAP typically runs directly over data link layers such as PPP or
IEEE 802, without requiring IP.
EAP over LAN or EAPOL encapsulates EAP packets onto 802 frames with a few extensions to
handle 802 characteristics. EAP over RADIUS encapsulates EAP packets onto RADIUS packets for
relaying to RADIUS authentication servers.
Figure 3 below shows the protocol conversation and flow between a supplicant, an authenticator and
an authentication server.
Figure 3. Protocol Conversation
The illustration above is described on the following steps:
1.
The supplicant (laptop/host) is initially blocked from accessing network services. For
example, the laptop user can access the switch management services as well as access other
hosts and their services in the network. The supplicant wanting to access these services starts
with an EAPOL-Start frame.
