S Layer 2 Managed Switch User Manual
陈泽科技有限公司
www.stephen-tele.com
29
Authentication process description:
Below is a simple description to the whole 802.1X authentication interactive process:
After
S
set some port as authentication port, all hosts that connected with this port can not forward data through switch.
Authentication client must start 802.1X authentication client software and send authentication requesting packet to
S
.
Then
S
will ask authentication username and password from authentication client. After the client send these, switch will
forward the username and password to Radius server for access right validation. When it is successful, switch will respond success
message to client and bind client’s MAC address with authentication port in order to make client forward data packet normally
through this port. During the interactive process, client and switch are transferring EAPOL (EAP OVER LAN) message while switch
and Radius server are transferring EAP message.
The EAPOL data packets that exchange between client and switch are as follows:
1: EAPOL-Star: Packet Type value is 1, initiative authentication frame, when user need authentication, it will initiate this frame and
it is from client to switch.
2: EAPOL-Logoff: Packet Type value is 2, quit request frame. When user does not need to use network, it will send this frame to
inform switch.
3: EAP-Packet: Packet Type value is 0, authentication information frame. It is used to contain authentication information.
There are four types data frame that exchange between switch and Radius server:
EAP-Request: Code value is 1, EAP request packet, request user name and password from switch to client.
EAP-Response: Code value is 2, EAP answer packet, transfer user name and password to switch from client.
EAP-Success: Code value is 3, EAP success packet, tell client that client user that authentication is successful. It is from switch to
client.
EAP-Failure: Code value is 4, EAP failure packet, tell client user that authentication is failure. It is from switch to client.
Below is a data packets exchange figure among 802.1x protocol client, switch and Radius server:
