Switch-Port Supplicant Operation - HP procurve switch 2600 series Access Security Manual

Configuring Port-Based Access Control (802.1x)
How 802.1x Operates
Port A1
Switch "A"
Port A1 Configured as an
802.1x Supplicant
Figure 7-2. Example of Supplicant Operation
7-6

Switch-Port Supplicant Operation

This operation provides security on links between 802.1x-aware switches. For
example, suppose that you want to connect two switches, where:
Switch "A" has port A1 configured for 802.1x supplicant operation.
■
■ You want to connect port A1 on switch "A" to port B5 on switch "B".
1. When port A1 on switch "A" is first connected to a port on switch "B", or
if the ports are already connected and either switch reboots, port A1
begins sending start packets to port B5 on switch "B".
• If, after the supplicant port sends the configured number of start
packets, it does not receive a response, it assumes that switch "B" is
not 802.1x-aware, and transitions to the authenticated state. If switch
"B" is operating properly and is not 802.1x-aware, then the link should
begin functioning normally, but without 802.1x security.
• If, after sending one or more start packets, port A1 receives a request
packet from port B5, then switch "B" is operating as an 802.1x
authenticator. The supplicant port then sends a response/ID packet.
Switch "B" forwards this request to a RADIUS server.
2. The RADIUS server then responds with an MD5 access challenge that
switch "B" forwards to port A1 on switch "A".
3. Port A1 replies with an MD5 hash response based on its username and
password or other unique credentials. Switch "B" forwards this response
to the RADIUS server.
4. The RADIUS server then analyzes the response and sends either a "suc
cess" or "failure" packet back through switch "B" to port A1.
• A "success" response unblocks port B5 to normal traffic from port A1.
Switch "B"
Port B5
LAN Core
RADIUS Server