3Com 4200G 12-Port Configuration Manual page 168

154 C 21: 802.1
HAPTER
C
X ONFIGURATION
Figure 50 802.1x authentication procedure (in EAP relay mode)
Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant Supplic ant
system system system system system system system system system system system system system system system
EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity EAP-Reques t/Identity
EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity EAP-Respons e/Identity
EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge EAP-Request/MD5 Challenge
EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge EAP-Res ponse/MD5 Challenge
[EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity] [EAP-Reques t/Identity]
[EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity] [EAP-Respons e/Identity]
The detailed procedure is as follows.
A supplicant system launches an 802.1x client to initiate an access request through
■
the sending of an EAPoL-start packet to the switch, with its user name and
password provided. The 802.1x client program then forwards the packet to the
switch to start the authentication process.
Upon receiving the authentication request packet, the switch sends an
■
EAP-request/identity packet to ask the 802.1x client for the user name.
The 802.1x program responds by sending an EAP-response/identity packet to the
■
switch with the user name included. The switch then encapsulates the packet in a
RADIUS Access-Request packet and forwards it to the RADIUS server.
Upon receiving the user name from the switch, the RADIUS server retrieves the
■
user name, finds the corresponding password by matching the user name in its
database, encrypts the password using a randomly-generated key, and sends the
key to the switch through an RADIUS access-challenge packet. The switch then
sends the key to the 802.1x client.
Upon receiving the key (encapsulated in an EAP-request/MD5 challenge packet)
■
from the switch, the client program encrypts the password of the supplicant
system with the key and sends the encrypted password (contained in an
EAP-response/MD5 challenge packet) to the RADIUS server through the switch.
(The encryption is irreversible.)
EAPoL EAPoL EAPoL
Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h Sw itc h
EAPoL -Start EAPoL -Start EAPoL -Start -Start -Start -Start -Start -Start -Start -Start -Start -Start -Start -Start -Start
EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success EAP-Success
Port author ized Port author ized Port author ized Port author ized Port acc epted Port author ized Port author ized Port acc epted Port acc epted Port author ized Port author ized Port acc epted Port author ized Port author ized Port author ized
Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet Hands hake r eques ting packet
Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket Hands hake r esponse pac ket
...... ...... ...... ...... ...... ...... ...... ...... ...... ...... ...... ...... ...... ...... ......
EAPoL-Logoff EAPoL-Logoff EAPoL-Logoff -Logoff -Logoff -Logoff -Logoff -Logoff -Logoff -Logoff -Logoff -Logoff -Logoff -Logoff -Logoff
Port rejected Port rejected Port rejected Port rejected
EAPoR EAPoR EAPoR
RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request
(EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity) (EAP-Res ponse/Identity)
RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge RADIUS Access -Challenge
(EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge) (EAP-Reques t/MD5 Challenge)
RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request RADIUS Access-Request
(EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge) (EAP-Res ponse/MD5 Challenge)
RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept RADIUS Access-Accept
(EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success) (EAP-Success)
Handshake timer time out Handshake timer time out Handshake timer time out Handshake timer time o Handshake timer time out Handshake timer time out Handshake timer time out Handshake timer time out Handshake timer time o Handshake timer time out Handshake timer time out Handshake timer time out Handshake timer time o Handshake timer time o Handshake timer time out
RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er RADIUS s erv er