FTOS Configuration Guide for the C-Series - Force10 Networks

4. The authentication server replies with an Access-Challenge. The Access-Challenge is request that the
supplicant prove that it is who it claims to be, using a specified method (an EAP-Method). The
challenge is translated and forwarded to the supplicant by the authenticator.
5. The supplicant can negotiate the authentication method, but if it is acceptable, the supplicant provides
the requested challenge information in an EAP Response, which is translated and forwarded to the
authentication server as another Access-Request.
6. If the identity information provided by the supplicant is valid, the authentication server sends an
Access-Accept frame in which network privileges are specified. The authenticator changes the port
state to authorized, and forwards an EAP Success frame. If the identity information is invalid, the
server sends and Access-Reject frame. The port state remains unauthorized, and the authenticator
forwards EAP Failure frame.
Figure 475 802.1X Authentication Process
Supplicant Authenticator Authentication
Server
EAP over LAN (EAPOL) EAP over RADIUS
Request Identity
Response Identity
EAP Request
EAP Reponse
EAP {Sucess | Failure}
Access Request
Access Challenge
Access Request
Access {Accept | Reject}
676 802.1X