802.1X Authentication Procedures; A Comparison Of Eap Relay And Eap Termination - HP 10500 Series Configuration Manual

802.1X authentication procedures

802.1X authentication has two approaches: EAP relay and EAP termination. You choose either mode
depending on the support of the RADIUS server for EAP packets and EAP authentication methods.
EAP relay mode
•
EAP relay is defined in IEEE 802.1X. In this mode, the network device uses EAPoR packets to send
authentication information to the RADIUS server, as shown in
Figure 38 EAP relay
EAP termination mode
•
In EAP termination mode, the network access device terminates the EAP packets received from the
client, encapsulates the client authentication information in standard RADIUS packets, and uses
(Password Authentication Protocol) PAP or (Password Authentication Protocol) CHAP to
authenticate to the RADIUS server, as shown in
Figure 39 EAP termination

A comparison of EAP relay and EAP termination

Packet exchange method
EAP relay
EAP termination
Benefits
•
Supports various EAP
authentication methods.
•
The configuration and processing is
simple on the network access
device.
Works with any RADIUS server that
supports PAP or CHAP authentication.
76
Figure 38.
Figure 39.
Limitations
The RADIUS server must support the
EAP-Message and
Message-Authenticator attributes,
and the EAP authentication method
used by the client.
•
Supports only MD5-Challenge
EAP authentication and the
"username + password" EAP
authentication initiated by an HP
iNode 802.1X client.
•
The processing is complex on the
network access device.