IES-P3073GC Series User Manual
ORing Industrial Networking Corp
66
authentication server. Frames sent between the supplicant and the switch are special 802.1X
frames, known as EAPOL (EAP Over LANs) frames which encapsulate EAP PDUs. Frames
sent between the switch and the RADIUS server are RADIUS packets. RADIUS packets also
encapsulate EAP PDUs together with other attributes like the switch's IP address, name, and
the supplicant's port number on the switch. EAP is very flexible as it allows for different
authentication methods, like MD5-Challenge, PEAP, and TLS. The important thing is that the
authenticator (the switch) does not need to know which authentication method the supplicant
and the authentication server are using, or how many information exchange frames are
needed for a particular method. The switch simply encapsulates the EAP part of the frame into
the relevant type (EAPOL or RADIUS) and forwards it.
When authentication is complete, the RADIUS server sends a special packet containing a
success or failure indication. Besides forwarding the result to the supplicant, the switch uses it
to open up or block traffic on the switch port connected to the supplicant.
Note: in an environment where two backend servers are enabled, the server timeout is
configured to X seconds (using the authentication configuration page), and the first server in
the list is currently down (but not considered dead), if the supplicant retransmits EAPOL Start
frames at a rate faster than X seconds, it will never be authenticated because the switch will
cancel on-going backend authentication server requests whenever it receives a new EAPOL
Start frame from the supplicant. Since the server has not failed (because the X seconds have
not expired), the same server will be contacted when the next backend authentication server
request from the switch. This scenario will loop forever. Therefore, the server timeout should
be smaller than the supplicant's EAPOL Start frame retransmission rate.
