CCNA Complete Guide 2nd Edition.pdf - Cisco Learning Home

Client
(Supplicant)
EAPOL-Start
EAP-Request/Identity
Switch or Access Point
(Authenticator)
EAP-Response/Identity RADIUS Access-Request
EAP-Request/Method
App06-22: 802.1X Authentication Message Exchange
- Below describes a typical WLAN 802.1X authentication process:
1) A wireless client becomes active on the medium. After the IEEE 802.11 WLAN
Probe Request/Response, Authentication, and Association processes, the access point
forces the port into an unauthorized state, which only 802.1X traffic is forwarded.
2) The access point replies with an EAP-Request Identity message to the wireless client to
obtain the client’s identity. The wireless client’s EAP-Response Identity message,
which contains the client’s identity, is forwarded to the authentication server.
3) The authentication server authenticates the wireless client and sends an Access Accept (or
Access Reject) message to the access point.
4) Upon receiving the Access Accept message, the access point relays the EAP-Success
message to the wireless client and transitions the client’s port to an authorized state and
normal traffic is forwarded.
- Note: Below lists the sequence of establishing WLAN connectivity with 802.1X authentication:
Probe Request, Probe Response, Authentication, Association, 802.1X authentication…
- When 802.1X is enabled, ports are authenticated before any other L2 or L3 features are enabled.
- Note: 802.1X is also considered as an efficient and effective alternative solution to port security.
294
RADIUS Access-Challenge
EAP-Response/Method RADIUS Access-Request
EAP-Success
EAPOL-Logoff
Port Authorized
Port Unauthorized
RADIUS Access-Accept
Authentication
Server
(RADIUS)
Copyright © 2008 Yap Chin Hoong
yapchinhoong@hotmail.com