Cisco Systems 2950 Ports in Authorized and Unauthorized States

10-4
Catalyst2950 and Catalyst2955 Switch Software Configuration Guide
78-11380-10
Chapter10 Configuring 802.1x Port-Based Authentication
Understanding 802.1x Port-Based Authentication
Figure10-2 Message Exchange
Ports in Authorized and Unauthorized States
The switch port state determines whether or not the client is granted access to the network. The port
starts in the unauthorized state. While in this state, the port disallows all ingress and egress traffic except
for 802.1x protocol packets. When a client is successfully au th ent ica ted, t h e por t tra nsiti ons to the
authorized state, allowing all traffic for the client to flow normally.
If a client that does not support 802.1x is connected to an una uthorized 802.1x port, the switch requests
the client’s identity. In this situation, the client does not respond to the request, the port remains in the
unauthorized state, and the client is not granted access to the ne twork .
In contrast, when an 802.1x-enabled client connects to a port that is not running the 802.1x pro tocol, the
client initiates the authentication process by sending the EAPOL-start frame. When no response is
received, the client sends the request for a fixed numb er o f t im es . B e cau se no re sp o nse is rece ived, th e
client begins sending frames as if the port is in the authorized state.
You control the port authorization state by using the dot1x port-control interface configuration
command and these keywords:
•force-authorized—disables 802.1x authentication and causes the po rt to transition to the authorized
state without any authentication exchange required. The port sends and receives normal traffic
without 802.1x-based authentication of the client. This is the default setting.
•force-unauthorized—causes the port to remain in the unauthorized state, ignoring all attempts by
the client to authenticate. The switch cannot provide authentication services to the cl ient through the
interface.
•auto—enables 802.1x authentication and causes the port to begin i n the unauthorized state, allowing
only EAPOL frames to be sent and received through the port. The aut h en ticati on proc ess begi ns
when the link state of the port transitions from down to up or when an EAPOL-start frame is
101228
Client
Port Authorized
Port Unauthorized
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/OTP
EAP-Response/OTP
EAP-Success
RADIUS Access-Request
RADIUS Access-Challenge
RADIUS Access-Request
RADIUS Access-Accept
EAPOL-Logoff
Authentication
server
(RADIUS)