Tls Server Authentication; Authentication With 802.1X - Extreme Networks Summit WM Technical Reference Manual

TLS server authentication

As part of the EAP-TLS, a client may use server authentication. AP 802.1X supplicant will not
authenticate the authentication server. Consequently, it does not need to be configured with the address
of a certificate repository, a collection of CA certificates, or a CRL during .1X authentication.

Authentication with 802.1X

In order to enable 802.1X authentication, the authenticator (AU) must be configured for 802.1X on the
port where the AP is connected. The access switch also needs to know the IP address (likely secret) of
the authentication server (AS). The AP performs authentication directly with the authentication server
through the authenticator. The Summit WM Controller does not participate in the authentication process
and is unaware of the AU or AS.
During the authentication, the AP continues sending non-802.1X traffic (discovery packets) on the
Ethernet port. In other words, if the network infrastructure requires 802.1X authentication the AP will
authenticate, but otherwise, it will not force authentication if the infrastructure does not require it.
802.1X authentication is usually triggered by the AU when the Ethernet link state changes or when the
AP is rebooted. On startup, the AP sends an EAP start message and waits for an EAP identity request
from the AS. If no identity request is received, the AP assumes that there is no 802.1X and enters into
authenticated state. If an identity request is received at a time later, the AP restarts the authentication. If
the authentication fails, the AP constantly retries the authentication from the beginning (sending EAP
start message).
The AP cannot connect to the Summit WM Controller or respond to telnet before the AU opens the
ports. Before deploying an AP in the 802.1X enabled network, the AP must be configured with the
correct credentials. Otherwise, if the credentials are wrong or the AP is not configured for 802.1X, the
AS blocks all traffic and the AP will be inaccessible for the Summit WM Controller or telnet. In such a
case, either the AP should be connected to another non-802.1X port or the 802.1X can be turned off on
the access switch for that port until the AP is connected to the Summit WM Controller and proper
authentication credentials are installed.
During the 802.1X authentication process, the AP LEDs signal the progress of the 802.1X authentication
and logs the events using Log Alarms. Log Alarms are available on the Summit WM Controller once the
AP connects to the Summit WM Controller.
107
Summit WM Technical Reference Guide, Software Version 5.1