TES-3080-M12(-BP2) User Manual
ORing Industrial Networking Corp
67
5.9.4 802.1x
The IEEE 802.1X standard defines a port-based access control procedure that prevents
unauthorized access to a network by requiring users to first submit credentials for
authentication. One or more backend servers (RADIUS
)
determine whether the user is allowed
access to the network.
In an 802.1X network environment, the user is called the supplicant, the switch is the
authenticator, and the RADIUS server is the authentication server. The switch acts as the
man-in-the-middle, forwarding requests and responses between the supplicant and the
authentication server. Frames sent between the supplicant and the switch are special 802.1X
frames, known as EAPOL (EAP Over LANs) frames which encapsulate EAP PDUs. Frames
sent between the switch and the RADIUS server are RADIUS packets. RADIUS packets also
encapsulate EAP PDUs together with other attributes like the switch's IP address, name, and
the supplicant's port number on the switch. EAP is very flexible as it allows for different
authentication methods, like MD5-Challenge, PEAP, and TLS. The important thing is that the
authenticator (the switch) does not need to know which authentication method the supplicant
and the authentication server are using, or how many information exchange frames are
needed for a particular method. The switch simply encapsulates the EAP part of the frame into
the relevant type (EAPOL or RADIUS) and forwards it.
When authentication is complete, the RADIUS server sends a special packet containing a
success or failure indication. Besides forwarding the result to the supplicant, the switch uses it
to open up or block traffic on the switch port connected to the supplicant.
Note: in an environment where two backend servers are enabled, the server timeout is
configured to X seconds (using the authentication configuration page), and the first server in
the list is currently down (but not considered dead), if the supplicant retransmits EAPOL Start
frames at a rate faster than X seconds, it will never be authenticated because the switch will
cancel on-going backend authentication server requests whenever it receives a new EAPOL
Start frame from the supplicant. Since the server has not failed (because the X seconds have
not expired), the same server will be contacted when the next backend authentication server
request from the switch. This scenario will loop forever. Therefore, the server timeout should
be smaller than the supplicant's EAPOL Start frame retransmission rate.
