3Com Switch 4500 26-Port, Руководство по настройке

Страница: 192 / 396

190 C
HAPTER
11: 802.1X C
ONFIGURATION
provided by 3Com (or by Microsoft Windows XP). The 802.1X Authentication
Server system normally stays in the carrier's AAA center.
Authenticator and Authentication Server exchange information through EAP
(Extensible Authentication Protocol) frames. The user and the Authenticator
exchange information through the EAPoL (Extensible Authentication Protocol over
LANs) frame defined by IEEE 802.1X. Authentication data are encapsulated in the
EAP frame, which is to be encapsulated in the packets of other AAA upper layer
protocols (for example, RADIUS) so as to go through the complicated network to
reach the Authentication Server. Such procedure is called EAP Relay.
There are two types of ports for the Authenticator. One is the Uncontrolled Port,
and the other is the Controlled Port. The Uncontrolled Port is always in
bi-directional connection state. The user can access and share the network
resources any time through the ports. The Controlled Port will be in connecting
state only after the user passes the authentication. Then the user is allowed to
access the network resources.
Figure 55 802.1X System Architecture
802.1X Authentication
Process
802.1X configures EAP frame to carry the authentication information. The
Standard defines the following types of EAP frames:
■
EAP-Packet: Authentication information frame, used to carry the
authentication information.
■
EAPoL-Start: Authentication originating frame, actively originated by the user.
■
EAPoL-Logoff: Logoff request frame, actively terminating the authenticated
state.
■
EAPoL-Key: Key information frame, supporting to encrypt the EAP packets.
■
EAPoL-Encapsulated-ASF-Alert: Supports the Alerting message of Alert
Standard Forum (ASF).
The EAPoL-Start, EAPoL-Logoff and EAPoL-Key only exist between the user and
the Authenticator. The EAP-Packet information is re-encapsulated by the
Authenticator System and then transmitted to the Authentication Server System.
Supplicant
Authenticator
PAE
Authenticator
Server
Supplicant
System
Authenticator System
Authenticator
Server
System
EAP protocol
exchanges
carried in
higher layer
protocol
EAPoL
Controlled
Port
Port
unauthorized
LAN
Uncontrolled
Port
Services
offered
by
Authenticators
System
(User)