z
o packets can pass through it.
The valid direction of a controlled port
figure it to be a unidirectional port, which
T
cant systems
connected to the port can access the network without being authenticated after one supplicant
The M
IEEE 802.1x
informatio
Figure 28-2
The mechanism of an 802.1x authentication system
The controlled port can be used to pass service packets when it is in authorized state. It is blocked
when not in authorized state. In this case, n
z
Controlled port and uncontrolled port are two properties of a port. Packets reaching a port are
visible to both the controlled port and uncontrolled port of the port.
When a controlled port is in unauthorized state, you can con
sends packets to supplicant systems only.
By default, a controlled port is a unidirectional port.
he way a port is controlled
A port of a 3Com series switch can be controlled in the following two ways.
z
Port-based authentication. When a port is controlled in this way, all the suppli
system among them passes the authentication. And when the authenticated supplicant system
goes offline, the others are denied as well.
z
MAC-based authentication. All supplicant systems connected to a port have to be authenticated
individually in order to access the network. And when a supplicant system goes offline, the others
are not affected.
echanism of an 802.1x Authentication System
authentication system uses the Extensible Authentication Protocol (EAP) to exchange
n between the supplicant system and the authentication server.
apsulated as EAP over RADIUS (EAPoR) packets or be terminated at system
mmunicate with RADIUS servers through Password
-Handshake Authentication Protocol (CHAP) packets.
cation, the authentication server passes the
henticator system. The authenticator system in
uthorized) of the controlled port according to the
US server.
The format of an EAPoL packet
sulation format defined in 802.1x. To enable EAP protocol packets to be
licant systems and authenticator systems through LANs, EAP protocol
k
PoL
k
z
EAP protocol packets transmitted between the supplicant system PAE and the authenticator
system PAE are encapsulated as EAPoL packets.
z
EAP protocol packets transmitted between the authenticator system PAE and the RADIUS server
can either be enc
PAEs. The system PAEs then co
Authentication Protocol (PAP) or Challenge
z
When a supplicant system passes the authenti
information about the supplicant system to the aut
turn determines the state (authorized or una
instructions (accept or reject) received from the RADI
Encapsulation of EAPoL Messages
EAPoL is a packet encap
transmitted between supp
pac ets are encapsulated in EAPoL format. The following figure illustrates the structure of an EA
pac et.
28-3
