CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

IEEE 802.1X Port-Based Authentication
- The IEEE 802.1X standard defines a client-server-based access control and authentication
protocol that restricts unauthorized devices from gaining access to a network through publicly
accessible ports. The authentication server authenticates a client connects to a switch port before
granting the available network services to the client.
- 802.1X allows only Extensible Authentication Protocol over LAN (EAPOL) traffic through
the switch port which an unauthenticated client is connected to. Normal traffic can pass through
the switch port after authentication is completed successfully.
- With 802.1X port-based authentication, network devices have the following device roles:
Client
(Supplicant)
Switch or
Access Point
(Authenticator)
Authentication
Server
The device (workstation) that requires access to the LAN. Responds to the
requests from the switch. Must be running 802.1X-compliant client software.
Controls the physical access to the network based on the authentication status
of the client. Acts as a proxy between the client and authentication server,
which requests identity information from the client, verify the information
with the authentication server, and relays the response to the client.
It is responsible for the re-encapsulation of the EAP and RADIUS frames
for communication with a client and an authentication server respectively.
Performs the authentication of the client. It validates the identity of the client
and notifies the switch or access point whether the client is authorized to
access the network. Currently, the RADIUS security system with EAP
extensions is the only supported authentication server.
Note: RADIUS is referred to as Remote Authentication Dial-In User Service.
Methods
Link
Layers
TLS
Figure A6-21: The EAP Architecture
- EAP is designed to run over any link layer and use any number of authentication methods.
293
AKA/
SIM
EAP
Token
Card
PPP 802.3 802.11
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com