Understanding How 802.1X Authentication Works - Cisco WS-X6066-SLB-APC - Content Switching Module Software Manual

Chapter 21 Configuring Switch Access Using AAA
Using a Non-Kerberized Login Procedure
If you use a non-Kerberized login procedure to log in to the switch, the switch takes care of
authentication to the KDC on behalf of the login client. However, the user password is now
transferred in clear text from the login client to the switch.
A non-Kerberized login can be performed through a modem or terminal server through the in-band
Note
management port. Telnet does not support non-Kerberized login.
If you launch a non-Kerberized login, the following process takes place:
1.
2.
3.
4.
5.
Figure 21-2
Figure 21-2 Non-Kerberized Telnet Connection
(Telnet client)

Understanding How 802.1x Authentication Works

IEEE 802.1x is a client-server-based access control and authentication protocol that restricts
unauthorized devices from connecting to a LAN through publicly accessible
ports. 802.1x authenticates each user device connected to a switch port before making available
any services offered by the switch or the LAN. Until the device is authenticated, 802.1x access
control allows only Extensible Authentication Protocol over LAN (EAPOL) traffic through the port
to which the device is connected. After authentication is successful, normal traffic can pass through
the port.
78-13315-02
The switch prompts you for a username and password.
The switch requests a TGT from the KDC so that you can be authenticated to the switch.
The KDC sends an encrypted TGT to the switch, which contains your identity, KDC's identity, and
TGT's expiration time.
The switch tries to decrypt the TGT with the password that you entered. If the decryption is
successful, you are authenticated to the switch.
If you want to access other network services, the KDC must be contacted directly for authentication.
To obtain the TGT, you can run the program "kinit," the client software provided with the Kerberos
package.
shows the non-Kerberized login process.
Host
1
Catalyst switch
Kerberos server
(contains KDC)
2
3
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
Understanding How Authentication Works
21-7