H3C Technologies H3C S5120 Series Switches - Manual (Page 380)

1-2
z Device, residing at the other end of the LAN segment, is the entity that authenticates connected
clients. Device is usually an 802.1X-enabled network device and provides access ports for clients
to the LAN.
z Server is the entity that provides authentication services to Device. Server, normally a RADIUS
(Remote Authentication Dial-in User Service) server, serves to perform authentications,
authorization, and accounting services for users.
Authentication Modes of 802.1X
The 802.1X authentication system employs the Extensible Authentication Protocol (EAP) to exchange
authentication information between the client, device, and authentication server.
z Between the client and the device, EAP protocol packets are encapsulated using EAPOL to be
transferred on the LAN.
z Between the device and the RADIUS server, EAP protocol packets can be exchanged in two
modes: EAP relay and EAP termination. In EAP relay mode, EAP packets are encapsulated in the
EAP over RADIUS (EAPOR) packets on the device, which then can relay the packets to the
RADIUS server. In EAP termination mode, EAP packets are terminated at the device, converted to
the RADIUS packets either with the Password Authentication Protocol (PAP) or Challenge
Handshake Authentication Protocol (CHAP) attribute, and then transferred to the RADIUS server.
Basic Concepts of 802.1X
These basic concepts are involved in 802.1X: controlled port/uncontrolled port, authorized
state/unauthorized state, and control direction.
Controlled port and uncontrolled port
A device provides ports for clients to access the LAN. Each port can be regarded as a unity of two
logical ports: a controlled port and an uncontrolled port.
z The uncontrolled port is always open in both the inbound and outbound directions to allow EAPOL
protocol packets to pass, guaranteeing that the client can always send and receive authentication
packets.
z The controlled port is open to allow data traffic to pass only when it is in the authorized state.
z The controlled port and uncontrolled port are two parts of the same port. Any packets arriving at the
port are available to both of them.
Authorized state and unauthorized state
The controlled port can be set in either the authorized or unauthorized status, which depends on the
authentication result, as shown in Figure 1-2 .