Eion LibraPlus 5845, Руководство пользователя, Страница: 56 / 140

• Authenticator – a device that acts as an intermediary between a supplicant and an authentication
server. Usually, the device is an access point.
The mutual authentication in 802.1x involves the following steps:
• A supplicant initiates a connection with an authenticator. The authenticator detects the initiation
and enables the port of the supplicant. However, all the traffic except 802.1x is blocked (this includes
DHCP, HTTP, FTP, SMTP and POP3).
• The authenticator then requests the identity from the supplicant.
• The supplicant then responds with the identity. The authenticator passes the identity to an authentic-
ation server.
• The authenticator server authenticates the identity of the supplicant. Once authenticated, an ACCEPT
message is sent to the authenticator. The authenticator then transitions the supplicant's port to an
authorized state.
• The supplicant then requests the identity from the authentication server. The authentication server
passes its identity to the supplicant
• Once the suppliant authenticates the identity of the authentication server, all traffic is forwarded
thereafter.
EAP
The exact method of supplying identity is defined in the Extensible Authentication Protocol (EAP).
EAP is the protocol that 802.1x uses to manage mutual authentication. The protocol provides a gener-
alized framework for a wireless network system to choose a specific authentication method to authen-
ticate. The authentication method can be passwords, PKI certificates or other authentication tokens.
With a standardized EAP, an authenticator does not need to understand the details about authentication
methods. The authenticator simply acts as a middleman to package and repackage EAP packets to pass
from a supplicant to an authentication server, where the actual authentication will take place.
There are several types of EAP methods that are in use today.
1.
LEAP
. This is a standard developed by Cisco. LEAP uses a username/password combination to
transmit the identity to the RADIUS server for authentication.
2.
EAP-TLS
. This is a standard outlined in RFC 2716. EAP-TLS uses X.509 certificates to handle
authentication. Both supplicant and authentication server exchange their X.509 certificates.
3.
EAP-TTLS
. This is a standard developed by Funk Software. EAP-TTLS is an alternative to EAP-
TLS. While the authenticator identifies itself to the client with a server certificate, the supplicant
uses a username/password identity.
4.
EAP-PEAP
(Protected EAP). Another standard designed to provide secure mutual authentication.
The standard is designed to overcome vulnerabilities that exist in other EAP methods.
WPA
The Wi-Fi Protected Access (WPA) is a standards-based interoperable security specification. The
specification is designed so that only software or firmware upgrades are necessary for the existing or
legacy hardware to meet the requirements. Its purpose is to increase the level of security for existing
and future wireless LANs.
WPA is based on a subset of the IEEE 802.11i standard, including the following key features to address
WEP vulnerabilities:
• Implements 802.1x EAP based authentication to enforce mutual authentication.
46
Configuration