Architecture Of 802.1X Authentication - H3C S3100-52P Operation Manual

Operation Manual – 802.1x and System Guard
H3C S3100-52P Ethernet switch
Timers Used in 802.1x
802.1x Implementation on an S3100-52P Switch

1.1.1 Architecture of 802.1x Authentication

As shown in
supplicant system, an authenticator system, and an authentication server system.
Figure 1-1 Architecture of 802.1x authentication
The supplicant system is an entity residing at one end of a LAN segment and is
authenticated by the authenticator system at the other end of the LAN segment.
The supplicant system is usually a user terminal device. An 802.1x authentication
is triggered when a user launches client program on the supplicant system. Note
that the client program must support the extensible authentication protocol over
LAN (EAPoL).
The authenticator system is another entity residing at one end of a LAN segment.
It authenticates the connected supplicant systems. The authenticator system is
usually an 802.1x-supported network device (such as a H3C series switch). It
provides the port (physical or logical) for the supplicant system to access the LAN.
The authentication server system is an entity that provides authentication service
to the authenticator system. Normally in the form of a RADIUS server, the
authentication server system serves to perform Authentication, Authorization, and
Accounting (AAA) services to users. It also stores user information, such as user
name, password, the VLAN a user belongs to, priority, and the Access Control
Lists (ACLs) applied.
The four basic concepts related to the above three entities are PAE, controlled port and
uncontrolled port, the valid direction of a controlled port and the way a port is controlled.
I. PAE
A port access entity (PAE) is responsible for implementing algorithms and performing
protocol-related operations in the authentication mechanism.
Figure 1-1, 802.1x adopts a client/server architecture with three entities: a
1-2
Chapter 1 802.1x Configuration