Eapol Authentication Process; Eapol Message Exchange - IBM RackSwitch G8000 Application Manual

EAPoL Authentication Process

EAPoL Message Exchange

© Copyright IBM Corp. 2011
The clients and authenticators communicate using Extensible Authentication
Protocol (EAP), which was originally designed to run over PPP, and for which the
IEEE 802.1X Standard has defined an encapsulation method over Ethernet frames,
called EAP over LAN (EAPOL).
initiated by the client.
Figure 1. Authenticating a Port Using EAPoL
802.1x Client
EAPOL
Ethernet
EAPOL-Start
EAP-Request (Credentials)
EAP-Response (Credentials)
EAP-Request (Credentials)
EAP-Response (Credentials)
EAP-Success
During authentication, EAPOL messages are exchanged between the client and the
G8000 authenticator, while RADIUS-EAP messages are exchanged between the
G8000 authenticator and the RADIUS server.
Authentication is initiated by one of the following methods:
• The G8000 authenticator sends an EAP-Request/Identity packet to the client
• The client sends an EAPOL-Start frame to the G8000 authenticator, which
responds with an EAP-Request/Identity frame.
The client confirms its identity by sending an EAP-Response/Identity frame to the
G8000 authenticator, which forwards the frame encapsulated in a RADIUS packet to
the server.
Figure 1 shows a typical message exchange
IBM Switch
Authenticator
(RADIUS Client)
Port Unauthorized
Radius-Access-Request
Radius-Access-Challenge
Radius-Access-Request
Radius-Access-Accept
Port Authorized
Chapter 6. 802.1X Port-Based Network Access Control
RADIUS
Server
RADIUS-EAP
UDP/IP
73