Planet GS-5220 Series User Manual page 365

Switch (802.1X device)—controls the physical access to the network based on the authentication status

of the client. The switch acts as an intermediary (proxy) between the client and the authentication server,
requesting identity information from the client, verifying that information with the authentication server,
and relaying a response to the client. The switch includes the RADIUS client, which is responsible for
encapsulating and decapsulating the Extensible Authentication Protocol (EAP) frames and interacting
with the authentication server. When the switch receives EAPOL frames and relays them to the
authentication server, the Ethernet header is stripped and the remaining EAP frame is re-encapsulated in
the RADIUS format. The EAP frames are not modified or examined during encapsulation, and the
authentication server must support EAP within the native frame format. When the switch receives
frames from the authentication server, the server's frame header is removed, leaving the EAP frame,
which is then encapsulated for Ethernet and sent to the client.
Authentication Initiation and Message Exchange

The switch or the client can initiate authentication. If you enable authentication on a port by using the
dot1x port-control auto interface configuration command, the switch must initiate authentication when
it determines that the port link state transitions from down to up. It then sends an EAP-request/identity
frame to the client to request its identity (typically, the switch sends an initial identity/request frame
followed by one or more requests for authentication information). Upon receipt of the frame, the client
responds with an EAP-response/identity frame.
However, if during bootup, the client does not receive an EAP-request/identity frame from the switch, the
client can initiate authentication by sending an EAPOL-start frame, which prompts the switch to request
the client's identity
If 802.1X is not enabled or supported on the network access device, any EAPOL frames
from the client are dropped. If the client does not receive an EAP-request/identity
frame after three attempts to start authentication, the client transmits frames as if
the port is in the authorized state. A port in the authorized state effectively means
that the client has been successfully authenticated.
When the client supplies its identity, the switch begins its role as the intermediary, passing EAP frames between
the client and the authentication server until authentication succeeds or fails. If the authentication succeeds, the
User's Manual of GS-5220 LCD Series
365