HP FlexNetwork NJ5000 User Manual page 268

EAP relay is defined in IEEE 802.1X. In this mode, the network device uses EAPOR packets to
send authentication information to the RADIUS server, as shown in
Figure 269 EAP relay
In EAP relay mode, the client must use the same authentication method as the RADIUS server.
On the network access device, you only need to enable EAP relay.
•
EAP termination mode:
In EAP termination mode, the network access device terminates the EAP packets received
from the client, encapsulates the client authentication information in standard RADIUS packets,
and uses PAP or CHAP to authenticate to the RADIUS server, as shown in
Figure 270 EAP termination
Comparing EAP relay and EAP termination
Packet exchange
method
EAP relay
EAP termination
EAP relay
Figure 271
EAP-MD5 is used.
Benefits
•
Supports various EAP
authentication methods.
•
The configuration and
processing is simple on
the network access
device.
Works with any RADIUS
server that supports PAP or
CHAP authentication.
shows the basic 802.1X authentication procedure in EAP relay mode, assuming that
Limitations
The RADIUS server must support the
EAP-Message and Message-Authenticator
attributes, and the EAP authentication
method used by the client.
•
Supports only MD5-Challenge EAP
authentication and the "username +
password" EAP authentication initiated
by an HPE iNode 802.1X client.
•
The processing is complex on the
network access device.
256
Figure 269.
Figure 270.