Chapter
Erro! Estilo não definido.
Erro! Estilo não definido.
6-23
Laptop
Radi us Ser ver
Br i dge
Et her net
Por t connect
Access bl ocked
EAPOL
RADI US
EAPOL- St ar t
EAP- Request / I dent i t y
EAP- Response/ I dent i t y
EAP- Request
EAP- Response( cr ed)
EAP- Success
Radi us- Access- Request
Radi us- Access- Chal l enge
Radi us- Access- Request
Radi us- Access- Request
Access al l owed
Fig. 6.2-9 Session Flow of Authentication Switching Among the Supplicant, Authenticator, and
Authentication Server
Authentication may be initiated by either users or the authentication system. When
detecting any unauthenticated user using network, the authentication system will
initiate authentication; users may initiate authentication by sending an EAPOL-Start
message to the authentication system by means of the Client software. If the identity of
the Client terminal is unknown, the authentication system will send an
EAP-Request/Identity message, requesting the Client terminal to send its identity. Thus
begins the typical authentication.
The Client terminal sends a Response packet to reply each Request. The authentication
system will send the user ID and password information to the Radius Server. Upon
receiving the user ID and password, the Radius Server searches in the database. If
authentication succeeds, it will send the Success message to the authentication system.
Upon receiving the Success message, the authentication system enables the
corresponding port of the system and forwards the message to the Client terminal. If
authentication fails, the authentication system will send the Failure message to users to
terminate the authentication.
To ensure the active state of the link between the user and the authentication system,
the authentication system can periodically implement re-authentication to prevent
abnormal system collapses due to subscriber premises equipment failures, which affect
