HP ProCurve 9304M Security Manual page 88

Security Guide for ProCurve 9300/9400 Series Routing Switches
The Client (known as a Supplicant in the 802.1X standard) provides username/password information to the
Authenticator. The Authenticator sends this information to the Authentication Server. Based on the Client's
information, the Authentication Server determines whether the Client can use services provided by the
Authenticator. The Authentication Server passes this information to the Authenticator, which then provides
services to the Client, based on the authentication result.
Figure 4.1 illustrates these roles.
Figure 4.1 Authenticator, Client/Supplicant, and Authentication Server in an 802.1X configuration
RADIUS Server
(Authentication Server)
HP Device
(Authenticator)
Client/Supplicant
Authenticator – The device that controls access to the network. In an 802.1X configuration, the HP device
serves as the Authenticator. The Authenticator passes messages between the Client and the Authentication
Server. Based on the identity information supplied by the Client, and the authentication information supplied by
the Authentication Server, the Authenticator either grants or does not grant network access to the Client.
Client/Supplicant – The device that seeks to gain access to the network. Clients must be running software that
supports the 802.1X standard (for example, the Windows XP operating system). Clients can either be directly
connected to a port on the Authenticator, or can be connected by way of a hub.
Authentication Server – The device that validates the Client and specifies whether or not the Client may access
services on the device. HP supports Authentication Servers running RADIUS.
Communication Between the Devices
For communication between the devices, 802.1X port security uses the Extensible Authentication Protocol
(EAP), defined in RFC 2284. The 802.1X standard specifies a method for encapsulating EAP messages so that
they can be carried over a LAN. This encapsulated form of EAP is known as EAP over LAN (EAPOL). The
standard also specifies a means of transferring the EAPOL information between the Client/Supplicant,
Authenticator, and Authentication Server.
4 - 2 June 2005