Eapol Configuration Guidelines - HP 438031-B21 - 1:10Gb Ethernet BL-c Switch Application Manual

Table 9 EAP support for RADIUS attributes
# Attribute
24 State
30 Called-Station-ID
31 Calling-Station-ID
79 EAP-Message
80 Message-Authenticator
87 NAS-Port-ID
Legend:
RADIUS Packet Types: A-R (Access-Request), A-A (Access-Accept), A-C (Access-Challenge), A-R (Access-Reject)
RADIUS Attribute Support:
0—This attribute MUST NOT be present in a packet.
0+—Zero or more instances of this attribute MAY be present in a packet.
0-1—Zero or one instance of this attribute MAY be present in a packet.
1—Exactly one instance of this attribute MUST be present in a packet.
1+—One or more of these attributes MUST be present.

EAPoL configuration guidelines

When configuring EAPoL, consider the following guidelines:
The 802.1x port-based authentication is currently supported only in point-to-point configurations, that
is, with a single supplicant connected to an 802.1x-enabled switch port.
When 802.1x is enabled, a port has to be in the authorized state before any other Layer 2 feature
can be operationally enabled. For example, the STG state of a port is operationally disabled while
the port is in the unauthorized state.
The 802.1x supplicant capability is not supported. Therefore, none of its ports can connect
successfully to an 802.1x-enabled port of another device, such as another switch, which acts as an
authenticator, unless access control on the remote port is disabled or is configured in forced-
authorized mode. For example, if a HP 1:10GbE switch is connected to another HP 1:10GbE
switch, and if 802.1x is enabled on both switches, the two connected ports must be configured in
force-authorized mode.
Attribute Value
Server-specific value. This is sent unmodified
back to the server in an Access-Request that is
in response to an Access-Challenge.
The MAC address of the authenticator
encoded as an ASCII string in canonical
format, e.g. 000D5622E3 9F.
The MAC address of the supplicant encoded
as an ASCII string in canonical format, e.g.
00034B436206.
Encapsulated EAP packets from the supplicant
to the authentication server (Radius) and vice-
versa. The authenticator relays the decoded
packet to both devices.
Always present whenever an EAP-Message
attribute is also included. Used to integrity-
protect a packet.
Name assigned to the authenticator port, e.g.
Server1_Port3
Port-based Network Access and traffic control
A-R
0-1
1
1
1+
1
1
A-A A-C A-R
0-1 0-1 0
0 0 0
0 0 0
1+ 1+ 1+
1 1 1
0 0 0
49