9-7
Cisco Catalyst Blade Switch 3130 and 3032 for Dell Software Configuration Guide
OL-12247-04
Chapter 9 Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
The specific exchange of EAP frames depends on the authentication method being used.
shows a message exchange initiated by the client when the client uses the One-Time-Password (OTP)
authentication method with a RADIUS server.
Figure 9-3
Message Exchange
If 802.1x authentication times out while waiting for an EAPOL message exchange and MAC
authentication bypass is enabled, the switch can authorize the client when the switch detects an Ethernet
packet from the client. The switch uses the MAC address of the client as its identity and includes this
information in the RADIUS-access/request frame that is sent to the RADIUS server. After the server
sends the switch the RADIUS-access/accept frame (authorization is successful), the port becomes
authorized. If authorization fails and a guest VLAN is specified, the switch assigns the port to the guest
VLAN. If the switch detects an EAPOL packet while waiting for an Ethernet packet, the switch stops
the MAC authentication bypass process and stops 802.1x authentication.
shows the message exchange during MAC authentication bypass.
201761
Client
Port Authorized
Port Unauthorized
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/OTP
EAP-Response/OTP
EAP-Success
RADIUS Access-Request
RADIUS Access-Challenge
RADIUS Access-Request
RADIUS Access-Accept
EAPOL-Logoff
Authentication
server
(RADIUS)
