SNR S2940-8G-v2, Configuration Manual

Page: 313 / 420

SNR S2940-8G-v2 Switch Configuration Guide
802.1x Configuration
Supplicant
PAE
Authenticator
System PAE
RADIUS
server
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
RADIUS Access-Request
(EAP-Response/Identity)
EAP-Request/EAP-TLS Start
RADIUS Access-Challenge
(EAP-Request/EAP-TLS Start)
EAP-Response/EAP-TLS client_hello
RADIUS Access-Request
(EAP-Response/EAP-TLS client_hello)
EAP-Response/EAP-TLS:
TLS serv er_hello, TLS certificat e,
TLS serv er_exchange, TLS certificat e_request,
TLS serv er_hello_done
EAPOL EAPOR
EAP-Response/EAP-TLS
RADIUS Access-Request
(EAP-Response/EAP-TLS)
EAP-Success
RADIUS Access-Accept
(EAP-Success)
RADIUS Access-Chall enge
(EAP-Response/EAP-TLS:
TLS serv er_hello, TLS certificat e,
TLS serv er_exchange, TLS certificat e_request,
TLS serv er_hello_done)
EAP-Response/EAP-TLS:
TLS certificat e, TLS client_key_exchange, [TLS
certificate_verify] TLS change_cipher_spec,
TLS finished
RADIUS Access-Chall enge
(EAP-Response/EAP-TLS: TLS certificat e, TLS
client_key_exchange, [TLS certificat e_verify]
TLS change_cipher_spec, TLS finished)
EAP-Response/EAP-TLS:
TLS change_cipher_spec, TLS finished
RADIUS Access-Chall enge
(EAP-Response/EAP-TLS: TLS
change_cipher_spec, TLS finished)
...
Figure 45.10: the Authentication Flow of 802.1x EAP-TLS
45.1.6 The Extension and Optimization of 802.1x
Besides supporting the port-based access authentication method specified by the protocol, de-
vices also extend and optimize it when implementing the EAP relay mode and EAP termination
mode of 802.1x.
• Supports some applications in the case of which one physical port can have more than one
users
• There are three access control methods (the methods to authenticate users): port-based,
MAC-based and user-based (IP MAC port).
– When the port-based method is used, as long as the first user of this port passes the
authentication, all the other users can access the network resources without being au-
thenticated. However, once the first user is offline, the network won't be available to all
the other users.
– When the MAC-based method is used, all the users accessing a port should be authen-
ticated separately, only those pass the authentication can access the network, while the
others can not. When one user becomes offline, the other users will not be affected.
– When the user-based (IP MAC port) method is used, all users can
access limited resources before being authenticated. There are two kinds of control in
313