66
Figure 27
EAP-Message attribute format
Message-Authenticator
RADIUS includes the Message-Authenticator attribute in all packets that have an EAP-Message attribute
to check their integrity. The packet receiver drops the packet if the calculated packet integrity checksum
is different than the Message-Authenticator attribute value. The Message-Authenticator prevents EAP
authentication packets from being tampered with during EAP authentication.
Figure 28
Message-Authenticator attribute format
Initiating 802.1X authentication
Both the 802.1X client and the access device can initiate 802.1X authentication.
802.1X client as the initiator
The client sends an EAPOL-Start packet to the access device to initiate 802.1X authentication. The
destination MAC address of the packet is the IEEE 802.1X specified multicast address 01-80-C2-00-00-
03 or the broadcast MAC address. If any intermediate device between the client and the authentication
server does not support the multicast address, you must use an 802.1X client (for example, the HP iNode
802.1X client) that can send broadcast EAPOL-Start packets.
Access device as the initiator
The access device initiates authentication, if a client (for example, the 802.1X client available with
Windows XP) cannot send EAPOL-Start packets.
The access device supports the following modes:
•
Multicast trigger
—The access device multicasts Identity EAP-Request packets periodically (every 30
seconds by default) to initiate 802.1X authentication.
•
Unicast trigger
—Upon receiving a frame with the source MAC address not in the MAC address
table, the access device sends an Identity EAP-Request packet out of the receiving port to the
unknown MAC address. It retransmits the packet if no response has been received within a certain
time interval.
802.1X authentication procedures
802.1X authentication has two approaches: EAP relay and EAP termination. You choose either mode
depending on the support of the RADIUS server for EAP packets and EAP authentication methods.
