802.1X Authentication Procedure - H3C S3600 Series Operation Manual

Hide thumbs Also See for S3600 Series:

Table of Contents

Operation Manual – 802.1x

H3C S3600 Series Ethernet Switches-Release 1510

Message-authenticator field. Otherwise, the packet is regarded as invalid and is

discarded.

type=80

Figure 1-7 The format of an Message-authenticator fiel

1.1.4 802.1x Authentication Procedure

A H3C3600 series Ethernet switch can authenticate supplicant systems in EAP

terminating mode or EAP relay mode.

I. EAP relay mode

This mode is defined in 802.1x. In this mode, EAP-packets are encapsulated in higher

level protocol (such as EAPoR) packets to enable them to successfully reach the

authentication server. Normally, this mode requires that the RADIUS server support the

two newly-added fields: the EAP-message field (with a value of 79) and the

Message-authenticator field (with a value of 80).

Four authentication ways, namely EAP-MD5, EAP-TLS (transport layer security),

EAP-TTLS, and PEAP (protected extensible authentication protocol), are available in

the EAP relay mode.

EAP-MD5 authenticates the supplicant system. The RADIUS server sends MD5

keys (contained in EAP-request/MD5 challenge packets) to the supplicant system,

which in turn encrypts the passwords using the MD5 keys.

EAP-TLS authenticates both the supplicant system and the RADIUS server by

checking their security licenses to prevent data from being stolen.

EAP-TTLS is a kind of extended EAP-TLS. EAP-TLS implements bidirectional

authentication between the client and authentication server. EAP-TTLS transmit

message using a tunnel established using TLS.

PEAP creates and uses TLS security channels to ensure data integrity and then

performs new EAP negotiations to verify supplicant systems.

Figure 1-8 describes the basic EAP-MD5 authentication procedure.

length=18

1-6

Chapter 1 802.1x Configuration

str

ing

Table of Contents