TL-SL3428_V3_User_Guide - TP-Link

supplicant system. Note that the client program must support the 802.1X authenticationprotocol.(2) Authenticator System: The authenticator system is usually an 802.1X-supported networkdevice, such as this TP-LINK switch. It provides the physical or logical port for thesupplicant system to access the LAN and authenticates the supplicant system.(3) Authentication Server System: The authentication server system is an entity thatprovides authentication service to the authenticator system. Normally in the form of aRADIUS server. Authentication Server can store user information and serve to performauthentication and authorization. To ensure a stable authentication system, an alternateauthentication server can be specified. If the main authentication server is in trouble, thealternate authentication server can substitute it to provide normal authentication service.‣ The Mechanism of an 802.1X Authentication SystemIEEE 802.1X authentication system uses EAP (Extensible Authentication Protocol) to exchangeinformation between the supplicant system and the authentication server.(1) EAP protocol packets transmitted between the supplicant system and the authenticatorsystem are encapsulated as EAPOL packets.(2) EAP protocol packets transmitted between the authenticator system and the RADIUSserver can either be encapsulated as EAPOR (EAP over RADIUS) packets or beterminated at authenticator system and the authenticator system then communicate withRADIUS servers through PAP (Password Authentication Protocol) or CHAP (ChallengeHandshake Authentication Protocol) protocol packets.(3) When a supplicant system passes the authentication, the authentication server passes theinformation about the supplicant system to the authenticator system. The authenticatorsystem in turn determines the state (authorized or unauthorized) of the controlled portaccording to the instructions (accept or reject) received from the RADIUS server.‣ 802.1X Authentication ProcedureAn 802.1X authentication can be initiated by supplicant system or authenticator system. When theauthenticator system detects an unauthenticated supplicant in LAN, it will initiate the 802.1Xauthentication by sending EAP-Request/Identity packets to the supplicant. The supplicant systemcan also launch an 802.1X client program to initiate an 802.1X authentication through the sendingof an EAPOL-Start packet to the switch,This TP-LINK switch can authenticate supplicant systems in EAP relay mode or EAP terminatingmode. The following illustration of these two modes will take the 802.1X authentication procedureinitiated by the supplicant system for example.(1) EAP Relay ModeThis mode is defined in 802.1X. In this mode, EAP-packets are encapsulated in higher levelprotocol (such as EAPOR) packets to allow them successfully reach the authentication server.This mode normally requires the RADIUS server to support the two fields of EAP: theEAP-message field and the Message-authenticator field. This switch supports EAP-MD5authentication way for the EAP relay mode. The following figure describes the basic EAP-MD5authentication procedure.158