HP ProCurve 9304M Security Manual page 91

Figure 4.4 Message exchange between Client/Supplicant, Authenticator, and Authentication Server
Client/Supplicant
In this example, the Authenticator (the HP device) initiates communication with an 802.1X-enabled Client. When
the Client responds, it is prompted for a username (255 characters maximum) and password. The Authenticator
passes this information to the Authentication Server, which determines whether the Client can access services
provided by the Authenticator. When the Client is successfully authenticated by the RADIUS server, the port is
authorized. When the Client logs off, the port becomes unauthorized again.
Starting in release 07.6.04, HP's 802.1X implementation supports dynamic VLAN assignment. If one of the
attributes in the Access-Accept message sent by the RADIUS server specifies a VLAN identifier, and this VLAN is
available on the HP device, the client's port is moved from its default VLAN to the specified VLAN. When the client
disconnects from the network, the port is placed back in its default VLAN. See "Configuring Dynamic VLAN
Assignment for 802.1X Ports" on page 4-16 for more information.
If a Client does not support 802.1X, authentication cannot take place. The HP device sends EAP-Request/Identity
frames to the Client, but the Client does not respond to them.
When a Client that supports 802.1X attempts to gain access through a non-802.1X-enabled port, it sends an EAP
start frame to the HP device. When the device does not respond, the Client considers the port to be authorized,
and starts sending normal traffic.
HP devices support Identity and MD5-challenge request types in EAP Request/Response messages. However,
devices running software release 07.8.00 has support for the following 802.1X authentication challenge types:
• EAP-TLS (RFC 2716) – EAP Transport Level Security (TLS) provides strong security by requiring both client
and authentication server to be identified and validated through the use of public key infrastructure (PKI)
digital certificates. EAP-TLS establishes a tunnel between the client and the authentication server to protect
messages from unauthorized users' eavesdropping activities. Since EAP-TLS requires PKI digital certificates
June 2005
HP Device
(Authenticator)
Configuring 802.1X Port Security
RADIUS Server
(Authentication Server)
4 - 5