Aaa And Radius Operation; System Architecture - 3Com 7700 Configuration Manual

9
IEEE 802.1x
802.1x System
Architecture
AAA
AND
This chapter covers the following topics:
IEEE 802.1x
■
Configuring the AAA and RADIUS Protocols
■
IEEE 802.1x (hereinafter simplified as 802.1x) is a port-based network access
control protocol that is used as the standard for LAN user access authentication.
In LANs that comply with IEEE 802 standards, the user can access devices and
share resources in the LAN by connecting a device such as the LAN Switch.
However, in telecom access, commercial LAN (a typical example is the LAN in the
office building) and mobile office etc., the LAN providers generally aim to control
the user's access. The requirement on the above-mentioned port-based network
access control" is the most applicable.
As the name implies, "port-based network access control" means to authenticate
and control all accessed devices on the port of the device. If the user's device can
pass authentication, the user can access resources in the LAN.
802.1x defines port based network access control protocol and only defines the
point-to-point connection between the access device and the access port. The
port can be either physical or logical. A typical application environment is as
follows: Each physical port of the LAN Switch only connects to one user
workstation (based on the physical port) and the wireless LAN access environment
(based on the logical port), etc.
The system using 802.1x is a typical C/S (Client/Server) system architecture. It
contains three entities: Supplicant System, Authenticator System and
Authentication Server System.
The LAN access control device needs to provide the Authenticator System of
802.1x. The devices at the user side such as the computers need to be installed
with the 802.1x client Supplicant software, for example, the 802.1x client
provided by Microsoft Windows XP. The 802.1x Authentication Server system
normally stays in the carrier's AAA center.
Authenticator and Authentication Server exchange information through EAP
(Extensible Authentication Protocol) frames. The Supplicant and the Authenticator
exchange information through the EAPoL (Extensible Authentication Protocol over
LANs) frame defined by IEEE 802.1x. Authentication data are encapsulated in the
EAP frame, which is encapsulated in packets of other AAA upper layer protocols
(e.g. RADIUS). This provides a channel through the complicated network to the
Authentication Server. Such procedure is called EAP Relay.
RADIUS O
PERATION