Eap Relay - HP V1910 Switch Series User Manual

EAP relay

Figure 286
EAP-MD5 is used.
Figure 286 802.1X authentication procedure in EAP relay mode
Client
(2) EAP-Request/Identity
(3) EAP-Response/Identity
(6) EAP-Request/MD5 challenge
(7) EAP-Response/MD5 challenge
(11) EAP-Request/Identity
(12) EAP-Response/Identity
When a user launches the 802.1X client software and enters a registered username and
1.
password, the 802.1X client software sends an EAPOL-Start packet to the network access device.
The network access device responds with an Identity EAP-Request packet to ask for the client
2.
username.
In response to the Identity EAP-Request packet, the client sends the username in an Identity
3.
EAP-Response packet to the network access device.
The network access device relays the Identity EAP-Response packet in a RADIUS Access-Request
4.
packet to the authentication server.
The authentication server uses the identity information in the RADIUS Access-Request to search its
5.
user database. If a matching entry is found, the server uses a randomly generated challenge
(EAP-Request/MD5 challenge) to encrypt the password in the entry, and sends the challenge in a
RADIUS Access-Challenge packet to the network access device.
The network access device relays the EAP-Request/MD5 Challenge packet in a RADIUS
6.
Access-Request packet to the client.
shows the basic 802.1X authentication procedure in EAP relay mode, assuming that
Device
EAPOL
(1) EAPOL-Start
(10) EAP-Success
Port authorized
...
(13) EAPOL-Logoff
Port unauthorized
(14) EAP-Failure
EAPOR
(4) RADIUS Access-Request
(EAP-Response/Identity)
(5) RADIUS Access-Challenge
(EAP-Request/MD5 challenge)
(8) RADIUS Access-Request
(EAP-Response/MD5 challenge)
(9) RADIUS Access-Accept
(EAP-Success)
317
Authentication server