TCP/IP Tutorial and Technical Overview - IBM Redbooks

3. The authentication server sends an EAP-Request/Authentication packet to
the authenticator over RADIUS and forwards this to the supplicant over
EAPoL. This packet requests the supplicant to prove its credentials using the
authentication type supported on the authentication server.
4. If the supplicant does not support the authentication type mentioned in the
EAP-Request/Authentication packet, it responds with an EAP-Nak message,
which indicates that the authentication type is not supported. The packet can
also include the desired type of authentication that the supplicant supports. If
the supplicant supports the authentication type, it responds with the
EAP-Response/Authentication packet to the authenticator, which forwards
this packet to the authentication server. The number of request and response
authentication messages exchanged depends on the authentication type in
use.
5. With a series of EAP-Request and -Response authentication packet
exchanges, the authentication server verifies the supplicant's credentials. If
credentials are proper, the authentication server sends an EAP-Success
packet to the authenticator, which is then forwarded to the supplicant. The
supplicant receives an EAP-Failure packet if it is not able to prove its
credentials. If the authentication is successful, the authenticator moves the
controlled port to the “authorized” state, allowing the supplicant to access the
network and Internet.
6. If the type of authentication is successful, the supplicant receives an
EAPOL-Key packet from the authenticator. IEEE 802.1x provides a way of
exchanging information related to the encryption key between the supplicant
and authenticator with the EAPOL-Key packet, helping in sharing a common
encryption key for that particular session. If you use PEAP, TLS, or TTLS
over EAP to provide authentication, the authentication server first sends
information related to encryption key to the authenticator. The authenticator
forwards this information as an EAPOL-Key packet to the supplicant.
7. If the supplicant wants to disconnect from the network after successful
authentication, it sends an EAPOL-Logoff packet to the authenticator. The
authenticator immediately moves the controlled port to the unauthorized state
disabling the supplicant from accessing the network.
Chapter 23. Port based network access control 897