3Com Switch 4800G 24-Port Configuration Manual page 721

Figure 217 Message exchange in EAP relay mode
Supplicant system
PAE
EAP -Request / Identity
EAP - Response / Identity
EAP -Request / MD5 challenge
EAP- Response / MD5 challenge
Handshake request
[ EAP- Request / Identity ]
Handshake response
[ EAP- Response / Identity ]
1 When a user launches the 802.1x client software and enters the registered
username and password, the 802.1x client software generates an EAPOL-Start
frame and sends it to the authenticator to initiate an authentication process.
2 Upon receiving the EAPOL-Start frame, the authenticator responds with an
EAP-Request/Identity packet for the username of the supplicant.
3 When the supplicant receives the EAP-Request/Identity packet, it encapsulates the
username in an EAP-Response/Identity packet and sends the packet to the
authenticator.
4 Upon receiving the EAP-Response/Identity packet, the authenticator relays the
packet in a RADIUS Access-Request packet to the authentication server.
5 When receiving the RADIUS Access-Request packet, the RADIUS server compares
the identify information against its user information table to obtain the
corresponding password information. Then, it encrypts the password information
using a randomly generated challenge, and sends the challenge information
through a RADIUS Access-Challenge packet to the authenticator.
6 After receiving the RADIUS Access-Challenge packet, the authenticator relays the
contained EAP-Request/MD5 Challenge packet to the supplicant.
EAPOL
Authenticator system
PAE
EAPOL -Start
EAP-Success
Port authorized
......
EAPOL - Logoff
Port unauthorized
802.1x Overview
EAPOR
RADIUS Access - Request
(EAP- Response / Identity )
RADIUS Access-Challenge
( EAP- Request / MD5 challenge )
RADIUS Access-Request
( EAP- Response / MD5 challenge )
RADIUS Access-Accept
(EAP- Success )
Handshake timer
721
RADUIS
server