802.1X Overview; 802.1X Port Behavior - Alcatel OmniSwitch 6624 Network Configuration Manual
Hide thumbs
Also See for OmniSwitch 6624:
- Troubleshooting manual (614 pages) ,
- Management manual (264 pages) ,
- Network configuration manual (654 pages)
Table of Contents
Advertisement
Configuring 802.1X
802.1X Overview
The 802.1X standard defines port-based network access controls, and provides the structure for authenti-
cating physical devices attached to a LAN. It uses the Extensible Authentication Protocol over LAN
(EAPOL).
There are three components for 802.1X:
The Supplicant—This is the device connected to the switch. The device may be connected directly to
•
the switch or via a point-to-point LAN segment. Typically the supplicant is a PC or laptop.
The Authenticator Port Access Entity (PAE)—This entity requires authentication from the suppli-
•
cant. The authenticator is connected to the supplicant directly or via a point-to-point LAN segment.
The OmniSwitch acts as the authenticator.
The Authentication Server—This component provides the authentication service and verifies the
•
credentials (username, password, challenge, etc.) of the supplicant. On the OmniSwitch, only RADIUS
servers are currently supported for 802.1X authentication.
Supplicant
PC
Note. The OmniSwitch itself cannot be an 802.1X supplicant.
802.1X Port Behavior
Before any device is authenticated through an 802.1X port, the port is blocked. The port will only accept
802.1X frames (EAPoL frames).
When an 802.1X frame is received from a supplicant, the switch sends an EAP packet to request the
supplicant's identity. The supplicant then sends the information (an EAP response), which is validated on
an authentication server set up for authenticating 802.1X ports. The server determines whether additional
information (a challenge, or secret) is required from the supplicant.
After the supplicant is successfully authenticated, the port is open only for the supplicant MAC address or
for any MAC address, depending on the global 802.1X configuration. The global configuration is
controlled by the
aaa authentication 802.1x
frames from the supplicant's MAC address will be allowed on the port after the supplicant is authenti-
cated. The keyword open-global specifies that any frames will be allowed on the port after the supplicant
is authenticated. (The open-unique state is the default). See
page 19-8
for more information about configuring this command.
OmniSwitch 6624/6648 Network Configuration Guide
Authenticator PAE
login request
OmniSwitch 6648
OmniSwitch 6648
OmniSwitch
802.1X Components
command. The keyword open-unique specifies that only
authentication
request
authorization
granted
"Setting 802.1X Switch Parameters" on
April 2004
802.1X Overview
Authentication
Server
RADIUS server
page 19-5
Advertisement
Table of Contents
