HP FlexNetwork NJ5000, User Manual

Page: 268 / 475

256
EAP relay is defined in IEEE 802.1X. In this mode, the network device uses EAPOR packets to
send authentication information to the RADIUS server, as shown in
Figure 269 .
Figure 269 EAP relay
In EAP relay mode, the client must use the same authentication method as the RADIUS server.
On the network access device, you only need to enable EAP relay.
•
EAP termination mode:
In EAP termination mode, the network access device terminates the EAP packets received
from the client, encapsulates the client authentication information in standard RADIUS packets,
and uses PAP or CHAP to authenticate to the RADIUS server, as shown in
Figure 270 .
Figure 270 EAP termination
Comparing EAP relay and EAP termination
Packet exchange
method
Benefits Limitations
EAP relay
•
Supports various EAP
authentication methods.
•
The configuration and
processing is simple on
the network access
device.
The RADIUS server must support the
EAP-Message and Message-Authenticator
attributes, and the EAP authentication
method used by the client.
EAP termination
Works with any RADIUS
server that supports PAP or
CHAP authentication.
•
Supports only MD5-Challenge EAP
authentication and the "us
password" EAP authentication initiated
by an HPE iNode 802.1X client.
•
The processing is complex on the
network access device.
EAP relay
Figure 271 shows the basic 802.1X authentication procedure in EAP relay mode, assuming that
EAP-MD5 is used.