72
802.1X fundamentals
This chapter describes the fundamentals of 802.1X. 802.1X is a port-based network access control
protocol initially proposed by the IEEE 802 LAN/WAN committee for the security of WLANs. It has
been widely used on Ethernet networks for access control.
802.1X controls network access by authenticating the devices connected to 802.1X-enabled LAN ports.
Architecture of 802.1X
802.1X operates in the client/server model. It comprises three entities: client (the supplicant), network
access device (the authenticator), and the authentication server, as shown in
.
Figure 28
Architecture of 802.1X
•
The client is an entity seeking access to the LAN. It resides at one end of a LAN segment and is
authenticated by the network access device at the other end of the LAN segment. The client is
typically an end-user terminal, such as a PC. 802.1X authentication is triggered when an 802.1X-
capable client program is launched on the client. The client program must support EAPOL.
•
The network access device, residing at the other end of the LAN segment, is the entity that
authenticates connected clients. The network access device provides the client with access to the
LAN.
•
The server is the entity that provides authentication services for the network access device. It
performs authentication, authorization, and accounting services for 802.1X users. It can be the
network access device or a remote server, normally a RADIUS server.
Controlled/uncontrolled port and
authorized/unauthorized port
802.1X defines two logical ports for an authenticated port: controlled port and uncontrolled port. Any
packets arriving at the port are available to both of them.
•
The controlled port is open to allow incoming and outgoing traffic to pass when it is in the
authorized state, and denies incoming and outgoing traffic when it is in the unauthorized state, as
shown in
. The controlled port is set in authorized state if the client has passed
authentication, and in unauthorized state if the client has failed authentication.
•
The uncontrolled port is open to receive and transmit EAPOL frames regardless of the authorization
state of the port.
