Authentication Procedure - H3C S3100 8C SI Operation Manual

Operation Manual – 802.1x-System Guard
H3C S3100 Series Ethernet Switches
Figure 1-6 The format of an EAP-message field
The Message-authenticator field, whose format is shown in
prevent unauthorized interception to access requesting packets during authentications
using CHAP, EAP, and so on. A packet with the EAP-message field must also have the
Message-authenticator field. Otherwise, the packet is regarded as invalid and is
discarded.
Figure 1-7 The format of an Message-authenticator field
1.1.4 802.1x Authentication Procedure
A H3C S3100 series Ethernet switch can authenticate supplicant systems in EAP
terminating mode or EAP relay mode.
I. EAP relay mode
This mode is defined in 802.1x. In this mode, EAP-packets are encapsulated in higher
level protocol (such as EAPoR) packets to enable them to successfully reach the
authentication server. Normally, this mode requires that the RADIUS server support the
two newly-added fields: the EAP-message field (with a value of 79) and the
Message-authenticator field (with a value of 80).
Four authentication ways, namely EAP-MD5, EAP-TLS (transport layer security),
EAP-TTLS (tunneled transport layer security), and PEAP (protected extensible
authentication protocol), are available in the EAP relay mode.
EAP-MD5 authenticates the supplicant system. The RADIUS server sends MD5
keys (contained in EAP-request/MD5 challenge packets) to the supplicant system,
which in turn encrypts the passwords using the MD5 keys.
EAP-TLS allows the supplicant system and the RADIUS server to check each
other's security certificate and authenticate each other's identity, guaranteeing
that data is transferred to the right destination and preventing data from being
intercepted.
EAP-TTLS is a kind of extended EAP-TLS. EAP-TLS implements bidirectional
authentication between the client and authentication server. EAP-TTLS transmit
message using a tunnel established using TLS.
1-6
Chapter 1 802.1x Configuration
Figure 1-7, is used to