802.1X Authentication Triggering; Authentication Process Of 802.1X - 3Com Baseline 2928 PWR Plus User Manual

Message-Authenticator
Figure 1-7 shows the encapsulation format of the Message-Authenticator attribute. The
Message-Authenticator attribute is used to prevent access requests from being snooped during EAP or
CHAP authentication. It must be included in any packet with the EAP-Message attribute; otherwise, the
packet will be considered invalid and discarded.
Figure 1-7 Encapsulation format of the Message-Authenticator attribute

802.1X Authentication Triggering

802.1X authentication can be initiated by either a client or the device.
Unsolicited triggering of a client
A client can initiate authentication unsolicitedly by sending an EAPOL-Start packet to the device. The
destination address of the packet is 01-80-C2-00-00-03, the multicast address specified by the IEEE
802.1X protocol.
Some devices in the network may not support multicast packets with the above destination address,
and unable to receive authentication requests of clients as a result. To solve this problem, the device
also supports EAPOL-Start packets using a broadcast MAC address as the destination address. This
solution requires the iNode 802.1X client.
Unsolicited triggering of the device
The device can trigger authentication by sending EAP-Request/Identity packets to unauthenticated
clients periodically (every 30 seconds by default). This method can be used to authenticate clients that
cannot send EAPOL-Start packets unsolicitedly to trigger authentication, for example, a client running
the 802.1X client application provided by Windows XP.

Authentication Process of 802.1X

An 802.1X device communicates with a remote RADIUS server in two modes: EAP relay and EAP
termination. The following describes the 802.1X authentication procedure in the two modes, which is
triggered by the client in the examples.
EAP relay
EAP relay is defined in IEEE 802.1X. In this mode, EAP packets are carried in an upper layer protocol,
such as RADIUS, so that they can go through complex networks and reach the authentication server.
Generally, relaying EAP requires that the RADIUS server support the EAP attributes of EAP-Message
and Message-Authenticator, which are used to encapsulate EAP packets and protect RADIUS packets
carrying the EAP-Message attribute respectively.
Figure 1-8 shows the message exchange procedure with EAP-MD5.
1-5