LANCOM GS
-
1224 and LANCOM GS
-
1224P
쮿
Chapter 4: Operation of Web- based Management
41
EN
The following figure shows the procedure of 802.1x authentication. There are
steps for the login based on 802.1x port access control management. The pro-
tocol used in the right side is EAPOL and the left side is EAP.
쐃
At the initial stage, the supplicant A is unauthenticated and a port on
switch acting as an authenticator is in unauthorized state. So the access
is blocked in this stage.
쐇
Initiating a session. Either authenticator or supplicant can initiate the
message exchange. If supplicant initiates the process, it sends an EAPOL-
start packet to the authenticator PAE and the authenticator will immedi-
ately respond with an EAP-Request/Identity packet.
쐋
The authenticator sends periodically an EAP-Request/Identity to the sup-
plicant requesting the identity that needs to be authenticated.
쐏
If the authenticator doesn’t send EAP-Request/Identity, the supplicant will
initiate the process by sending the EAPOL-Start to the authenticator.
쐄
Next, the Supplicant replies an EAP-Response/Identity to the authentica-
tor. The authenticator will embed the user ID into RADIUS-Access-
Request command and send it to the authentication server for confirming
its identity.
쐂
After receiving the RADIUS-Access-Request, the authentication server
sends a RADIUS-Access-Challenge to the supplicant to ask for the user
password via the authenticator PAE.
쐆
The supplicant converts the user password into the credential information,
in MD5 format and replies an EAP-Response with this credential informa-
tion as well as the specified authentication algorithm (MD5 or OTP) to the
authentication server via the authenticator PAE. As per the value of the
type field in the message PDU, the authentication server knows which
algorithm should be applied to authenticate the credential information,
EAP-MD5 (Message Digest 5) or EAP-OTP (One Time Password) or other
algorithms.
쐊
If user ID and password are correct, the authentication server will send a
RADIUS-Access-Accept to the authenticator. If not correct, the authenti-
cation server will send a RADIUS-Access-Reject.
쐎
When the authenticator PAE receives a RADIUS-Access-Accept, it will
send an EAP-Success to the supplicant. At this time, the supplicant is
authorized and the port connected to the supplicant and under 802.1x
