SNR S2940-8G-v2, Руководство по настройке

Страница: 312 / 420

SNR S2940-8G-v2 Switch Configuration Guide
802.1x Configuration
Supplicant
PAE
Authenticator
System PAE
RADIUS
server
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
RADIUS Access-Request
(EAP-Response/Identity)
EAP-Request/MD5 Challenge
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
EAP-Success
RADIUS Access-Accept
(EAP-Success)
EAPOL EAPOR
Handshake request packet
[EAP-Request/Identity]
Handshake response packet
{EAP-Response/Identity]
EAPOL-Logoff
...
Port authorized
Port unauthorized
Expiry of the handshake timer
Figure 45.9: the Authentication Flow of 802.1x EAP-MD5
encrypted tunnel established via the certificate of the authentication server. Any kind of authenti-
cation request including EAP, PAP and MS-CHAPV2 can be transmitted within TTLS tunnels.
4. PEAP Authentication Method
EAP-PEAP is brought up by Cisco, Microsoft and RAS Security as a recommended open stan-
dard. It has long been utilized in products and provides very good security. Its design of protocol
and security is similar to that of EAP-TTLS, using a server's PKI certificate to establish a safe TLS
tunnel in order to protect user authentication.
The following figure illustrates the basic operation flow of PEAP authentication method.
EAP Termination Mode
In this mode, EAP messages will be terminated in the access control unit and mapped into RADIUS
messages, which is used to implement the authentication, authorization and fee-counting. The
basic operation flow is illustrated in the next figure.
In EAP termination mode, the access control unit and the RADIUS server can use PAP or
CHAP authentication method. The following figure will demonstrate the basic operation flow using
CHAP authentication method.
312