Avaya AP-4, AP-5, AP-6 - page 221

Security
Avaya Wireles s AP-4/5/6 Us er’s Guide 4 -123
Prior to successful authentication, an unauthenticated client PC cannot
send any data traffic through the AP device to other systems on the LAN.
The AP inhibits all data traffic from a particular client PC until the client PC
is authenticated. Regardless of its authentication status, a client PC can
always exchange 802.1x messages in the clear with the AP (the client
begins encrypting data after it has been authenticated).
Figure 4-16. RADIUS Authentication Illustrated
The AP acts as a pass-through device to facilitate communications
between the client PC and the RADIUS server. The AP (2) and the client
(1) exchange 802.1x messages using an EAPOL (EAP Over LAN)
protocol (A). Messages sent from the client station are encapsulated by
the AP and transmitted to the RADIUS (3) server using EAP extensions
(B).