HP 5120 EI Switch Series Configuration Manual page 80

Figure 32 802.1X authentication procedure in EAP termination mode
Client
EAPOL
(1) EAPOL-Start
(2) EAP-Request / Identity
(3) EAP-Response / Identity
(4) EAP-Request / MD5 challenge
(5) EAP-Response / MD5 challenge
(8) EAP-Success
(9) EAP-Request/Identity
(10) EAP-Response/Identity
...
(11) EAPOL-Logoff
(14) EAP-Failure
In EAP termination mode, it is the network access device rather than the authentication server generates
an MD5 challenge for password encryption (see Step 4). The network access device then sends the MD5
challenge together with the username and encrypted password in a standard RADIUS packet to the
RADIUS server.
Device
(6) RADIUS Access-Request
(CHAP-Response/MD5 challenge)
(7) RADIUS Access-Accept
(CHAP-Success)
Port authorized
Port unauthorized
70
Authentication server
RADIUS