3com 4210 PWR 9-Port 3CR17341-91-ME User Manual
Product codes
3CR17341-91-ME
Introduction to 802.1x
213
The way a port is controlled
A port of a 3Com series switch can be controlled in the following two ways.
■
Port-based authentication. When a port is controlled in this way, all the
supplicant systems connected to the port can access the network without
being authenticated after one supplicant system among them passes the
authentication. And when the authenticated supplicant system goes offline,
the others are denied as well.
supplicant systems connected to the port can access the network without
being authenticated after one supplicant system among them passes the
authentication. And when the authenticated supplicant system goes offline,
the others are denied as well.
■
MAC address-based authentication. All supplicant systems connected to a port
have to be authenticated individually in order to access the network. And when
a supplicant system goes offline, the others are not affected.
have to be authenticated individually in order to access the network. And when
a supplicant system goes offline, the others are not affected.
The Mechanism of an
802.1x Authentication
System
IEEE 802.1x authentication system uses the extensible authentication protocol
(EAP) to exchange information between supplicant systems and the authentication
servers.
(EAP) to exchange information between supplicant systems and the authentication
servers.
Figure 66 The mechanism of an 802.1x authentication system
■
EAP protocol packets transmitted between the supplicant system PAE and the
authenticator system PAE are encapsulated as EAPoL packets.
authenticator system PAE are encapsulated as EAPoL packets.
■
EAP protocol packets transmitted between the authenticator system PAE and
the RADIUS server can either be encapsulated as EAP over RADIUS (EAPoR)
packets or be terminated at system PAEs. The system PAEs then communicate
with RADIUS servers through password authentication protocol (PAP) or
challenge-handshake authentication protocol (CHAP) packets.
the RADIUS server can either be encapsulated as EAP over RADIUS (EAPoR)
packets or be terminated at system PAEs. The system PAEs then communicate
with RADIUS servers through password authentication protocol (PAP) or
challenge-handshake authentication protocol (CHAP) packets.
■
When a supplicant system passes the authentication, the authentication server
passes the information about the supplicant system to the authenticator
system. The authenticator system in turn determines the state (authorized or
unauthorized) of the controlled port according to the instructions (accept or
reject) received from the RADIUS server.
passes the information about the supplicant system to the authenticator
system. The authenticator system in turn determines the state (authorized or
unauthorized) of the controlled port according to the instructions (accept or
reject) received from the RADIUS server.
Encapsulation of EAPoL
Messages
The format of an EAPoL packet
EAPoL is a packet encapsulation format defined in 802.1x. To enable EAP protocol
packets to be transmitted between supplicant systems and authenticator systems
through LANs, EAP protocol packets are encapsulated in EAPoL format. The
following figure illustrates the structure of an EAPoL packet.
packets to be transmitted between supplicant systems and authenticator systems
through LANs, EAP protocol packets are encapsulated in EAPoL format. The
following figure illustrates the structure of an EAPoL packet.
Figure 67 The format of an EAPoL packet
Supplicant System
PAE
Authenticator System
PAE
Authentication Server
System
EAPOL
RADIUS
0
15
PAE Ethernet type
Packet body
Type
Protocol version
Length
7
2
4
6
N