EDS-508A/505A Series User’s Manual
Featured Functions
3-68
The IEEE 802.1X Concept
Three components are used to create an authentication mechanism based on 802.1X standards:
Client/Supplicant, Authentication Server, and Authenticator.
Supplicant:
The end station that requests access to the LAN and switch services and responds to
the requests from the switch.
Authentication server:
The server that performs the actual authentication of the supplicant.
Authenticator:
Edge switch or wireless access point that acts as a proxy between the supplicant
and the authentication server, requesting identity information from the supplicant, verifying the
information with the authentication server, and relaying a response to the supplicant.
The EDS acts as an authenticator in the 802.1X environment. A supplicant and an authenticator
exchange EAPOL (Extensible Authentication Protocol over LAN) frames with each other. We can
either use an external RADIUS server as the authentication server, or implement the authentication
server in the EDS by using a Local User Database as the authentication look-up table. When we
use an external RADIUS server as the authentication server, the authenticator and the
authentication server exchange EAP frames between each other.
Authentication can be initiated either by the supplicant or the authenticator. When the supplicant
initiates the authentication process, it sends an “EAPOL-Start” frame to the authenticator. When
the authenticator initiates the authentication process or when it receives an “EAPOL Start” frame,
it sends an “EAP Request/Identity” frame to ask for the username of the supplicant. The following
actions are described below:
Message Exchange
Authentication
server
(RADIUS)
Client
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/OTP
EAP-Response/OTP
EAP-Success
EAPOL-Logoff
Port Authorized
Port Unauthorized
RADIUS Access-Request
RADIUS Access-Challenge
RADIUS Access-Request
RADIUS Access-Accept