Ge MULTILINK ML1200 User Manual download pdf (Page 126)

7–2 MULTILINK ML1200 MANAGED FIELD SWITCH – INSTRUCTION MANUAL

ACCESS USING RADIUS CHAPTER 7: ACCESS USING RADIUS

access to services that are accessible via that port. The authenticator is responsible for

communication with the supplicant and for submitting the information received from the

supplicant to a suitable authentication server. This allows the verification of user

credentials to determine the consequent port authorization state. It is important to note

that the authenticator's functionality is independent of the actual authentication method.

It effectively acts as a pass-through for the authentication exchange.

FIGURE 7–1: 802.1x network components

The RADIUS server is the authentication server. The authentication server provides a

standard way of providing Authentication, Authorization, and Accounting services to a

network. Extensible Authentication Protocol (EAP) is an authentication framework which

supports multiple authentication methods. EAP typically runs directly over data link layers

such as PPP or IEEE 802, without requiring IP. EAP over LAN (EAPOL) encapsulates EAP

packets onto 802 frames with a few extensions to handle 802 characteristics. EAP over

RADIUS encapsulates EAP packets onto RADIUS packets for relaying to RADIUS

authentication servers.

The details of the 802.1x authentication are as follows.

1. The supplicant (host) is initially blocked from accessing the network. The

supplicant wanting to access these services starts with an EAPOL-Start frame.

2. The authenticator (MultiLink ML1200 Managed Field Switch), upon receiving an

EAPOL-start frame, sends a response with an EAP-Request/Identity frame

back to the supplicant. This will inform the supplicant to provide its identity.

3. The supplicant then sends back its own identification using an EAP-Response/

Identity frame to the authenticator (MultiLink ML1200 Managed Field Switch).

The authenticator then relays this to the authentication server by

encapsulating the EAP frame on a RADIUS-Access-Request packet.

4. The RADIUS server will then send the authenticator a RADIUS-Access-

Challenge packet.

5. The authenticator (MultiLink ML1200 Managed Field Switch) will relay this

challenge to the supplicant using an EAP-Request frame. This will request the

supplicant to pass its credentials for authentication.

6. The supplicant will send its credentials using an EAP-Response packet.

7. The authenticator will relay using a RADIUS-Access-Request packet.

8. If the supplicant's credentials are valid, RADIUS-Access-Accept packet is sent

to the authenticator.

9. The authenticator will then relay this on as an EAP-Success and provides

access to the network.

1 2 ... 121 122 123 124 125 126 127 128 129 130 131 ... 343 344

No comments

Ge MULTILINK ML1200 User Manual Page 126