Ports In Authorized And Unauthorized States - Cisco WS-C6506 Software Manual

Understanding How 802.1X Authentication Works
When the host supplies its identity, the switch acts as the intermediary, passing the EAP frames between
the host and the authentication server until authentication succeeds or fails. If the authentication
succeeds, the switch port becomes authorized. For more information, see the
Unauthorized States" section on page
The specific exchange of EAP frames depends on the authentication method that is being used.
Figure 40-2
authentication method with a RADIUS server.
Figure 40-2
Supplicant

Ports in Authorized and Unauthorized States

The switch port state determines if the host is granted access to the network. The port starts in the
unauthorized state. In this state, the port disallows all the ingress and egress traffic except for the 802.1X
protocol packets. When a host is successfully authenticated, the port transitions to the authorized state,
which allows all traffic for the host to flow normally.
If a host that does not support 802.1X is connected to an unauthorized 802.1X port, the switch requests
the host's identity. In this situation, the host does not respond to the request, the port remains in the
unauthorized state, and the host is not granted access to the network.
When an 802.1X-enabled host connects to a port that is not running the 802.1X protocol, the host
initiates the authentication process by sending the EAPOL-start frame. When no response is received,
the host sends the request for a fixed number of times. Because no response is received, the host begins
sending frames as if the port is in the authorized state.
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
40-4
shows a message exchange that is initiated by the host using the One-Time-Password (OTP)
Message Exchange
Catalyst switch
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/OTP
EAP-Response/OTP
EAP-Success
Port Authorized
EAPOL-Logoff
Port Unauthorized
40-4.
RADIUS Access-Request
RADIUS Access-Challenge
RADIUS Access-Request
RADIUS Access-Accept
Chapter 40 Configuring 802.1X Authentication
"Ports in Authorized and
Authentication
server
(RADIUS)
OL-8978-04