Port-Based Authentication; Introduction; Feature Overview - Nokia ESB26 User Manual

34. 802.1X Port-Based
Authentication

Introduction

The IEEE 802.1X standard offers a method for controlling port access in a central location on
a user or device basis. 802.1X helps to facilitate the control of networks.
The 802.1X (or dot1x) standard relies on the supplicant (user or client that requests
authentication) to provide credentials in order to gain access to the network. The credentials
can be a username/password combination or a certificate. The credentials are not verified by
the switch but are sent to a Remote Authentication Dial-In User Service (RADIUS) server,
which maintains a database of authentication information.
Dot1x acts as Authenticators in a local network. BiNOS supports the MD5 authentication
method without accounting.

Feature Overview

IEEE 802.1X standard relies on the Extensible Authentication Protocol (EAP) and passes it
over a wired or wireless LAN. EAP is an authentication protocol that provides a framework
for authentication methods instead of simply employing usernames and passwords for access.
The protocol in 802.1X is called EAP encapsulation over LANs (EAPOL). Communication
between supplicants in the network and the Authentication Server is performed through
EAPOL packets.
802.1X consists of three components for port control – Supplicant, Authentication Server and
Authenticator.
Supplicant
A supplicant is the user or client that wants to be authenticated. This is the end device that
connects to a switch and requests to use the services (port) of the device. The 802.1X
supplicant must be able to respond to EAP packets.
Authentication Server
Authentication Server is the actual server that authenticates the supplicants and typically, this
is a RADIUS server. The RADIUS server examines the credentials provided to the
authenticator from the supplicant and provides the authentication service.
Authenticator
Authenticator is the device in-between the supplicant and the authentication server. The
802.1X key point is that the authenticator is very simple as the supplicant and the
authentication server performs most of the authentication process.
MN700004 Rev 01 360