ZyXEL Communications SBG3300 series User Manual page 33

2. Supplicant:
The station (i.e. Wireless client) that is being authenticated by an authenticator
attached to the Wireless network. The supplicant requests access to the LAN services
and responds to the requests from the authenticator. The station must be running
802.1x-compliant client software, such as that offered in the Microsoft Windows XP
operating system, Meeting House AEGIS 802.1x client or Odyssey 802.1x client.
3. Authentication Server:
The device (i.e. RADIUS server) that provides an authentication service to an
authenticator. This service determines, from the credentials provided by the
supplicant, whether the supplicant is authorized to access the services provided by
the authenticator. The authentication server performs the actual authentication of
the client. It validates the identity of the supplicant. Because the authenticator acts
as a proxy, the authentication service is transparent to the supplicant.
Some Wireless APs (i.e. ZyXEL Wireless AP) have a built-in authentication server,
therefore an external RADIUS authentication server is not needed. In this case, the
Wireless AP acts as both authenticator and authentication server.

Authentication Port State and Authentication Control
The port state determines whether or not the supplicant (Wireless Client) is
granted access to the network behind the Wireless AP. There are two authentication
port states on the AP, authorized state and unauthorized state.
By default, the port starts in the unauthorized state. While in this state, the port
disallows all incoming and outgoing data traffic, except for 802.1x packets. When a
supplicant is successfully authenticated, the port transits to the authorized state,
allowing all the traffic for client to flow normally. If a client that does not support the
802.1x is connected to an unauthorized 802.1x port, the authenticator requests the
client's identity. In this situation, the client does not respond to the 802.1x request;
the port remains in the unauthorized state and the client is not granted access to the
network.