3Com Switch 4200G Configuration Guide

154 CHAPTER 21: 802.1X CONFIGURATION
Figure 50 802.1x authentication procedure (in EAP relay mode)
The detailed procedure is as follows.
■ A supplicant system launches an 802.1x client to initiate an access request through
the sending of an EAPoL-start packet to the switch, with its user name and
password provided. The 802.1x client program then forwards the packet to the
switch to start the authentication process.
■ Upon receiving the authentication request packet, the switch sends an
EAP-request/identity packet to ask the 802.1x client for the user name.
■ The 802.1x program responds by sending an EAP-response/identity packet to the
switch with the user name included. The switch then encapsulates the packet in a
RADIUS Access-Request packet and forwards it to the RADIUS server.
■ Upon receiving the user name from the switch, the RADIUS server retrieves the
user name, finds the corresponding password by matching the user name in its
database, encrypts the password using a randomly-generated key, and sends the
key to the switch through an RADIUS access-challenge packet. The switch then
sends the key to the 802.1x client.
■ Upon receiving the key (encapsulated in an EAP-request/MD5 challenge packet)
from the switch, the client program encrypts the password of the supplicant
system with the key and sends the encrypted password (contained in an
EAP-response/MD5 challenge packet) to the RADIUS server through the switch.
(The encryption is irreversible.)
Supplicant
system
Sw itc h
RADIUS serv er
EAPoL
EAPoR
EAPoL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
EAPoL-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port accepted
Handshake timer time o
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Port rejected
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port accepted
Handshake timer time o
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Port rejected
Supplicant
system
Sw itc h
RADIUS serv er
EAPoL
EAPoR
EAPoL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
EAPoL-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
EAPoL
EAPoR
EAPoL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
EAPoL-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port accepted
Handshake timer time o
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Port rejected
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port authorized
Handshake timer time out
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Supplicant
system
Sw itc h
RADIUS serv er
-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/MD5 Challenge
EAP-Success
EAP-Response/MD5 Challenge
RADIUS Access-Request
(EAP-Response/Identity)
RADIUS Access-Challenge
(EAP-Request/MD5 Challenge)
RADIUS Access-Accept
(EAP-Success )
RADIUS Access-Request
(EAP-Response/MD5 Challenge)
Port accepted
Handshake timer time o
Handshake requesting packet
[EAP-Request/Identity]
Handshake response pac ket
[EAP-Respons e/Identity]
-Logoff
......
Port rejected