Ruijie RG-S2900G-E Series, Configuration Manual

Page: 505 / 943

Configuration Guide 802.1x Configuration
required for an MAC address (01-80-C2-00-00-03) for the protocol for packet exchange during the initial authentication
process.
The following diagram shows a typical authentication process, during which the three role devices exchange packets with
one another.
Figure 0-1
This is a typical authentication process initiated by users (in some special cases, the switch can actively initiate
authentication request, whose process is the same as that shown in the diagram, except that it does not contain the step
where the user actively initiates the request).
States of Authorized Users and Unauthorized Users
The 802.1x determines whether the users on the port are allowed to access the network according to the authentication
status of the port. Since we expand the 802.1X based on users, we determine whether a user is allowed to access
network resources according to the authentication status of that user under a port. All users under an uncontrolled port
can use network resources, while those under a controlled port can access network resources only if they are authorized.
When a user just initiates an authentication request, its status is unauthorized, in which case it cannot access the network.
When it passes the authentication, its status changes to be authorized, in which case it can use the network resources.
If the workstation does not support 802.1x while the machine is connected with the controlled port, when the equipment
requests the username of the user, the workstation will not respond to the request due to no support. This means that the
user is still unauthorized and cannot access the network resources.
On the contrary, if the client supports 802.1x, while the connected switch does not: The EAPOL-START frames from the
user are not responded, and the user deems it connected port as an uncontrolled port and directly uses network
resources, when the user fails to receive any response after it sends the specified number of EAPOL-START frames.
On a 802.1x-enabled device, all ports are uncontrolled ports by default. We can set a port as a controlled port, to impose
authentication over all the users under that port.