Cisco Systems 3750E manual 10-6, EAPOL-Start

Chapter 10 Configuring IEEE 802.1x Port-Based Authentication

Understanding IEEE 802.1x Port-Based Authentication

Figure 10-3		Message Exchange
				Authentication
Client				server
				(RADIUS)
		EAPOL-Start
	EAP-Request/Identity
	EAP-Response/Identity			RADIUS Access-Request
		EAP-Request/OTP	RADIUS Access-Challenge
	EAP-Response/OTP			RADIUS Access-Request
		EAP-Success		RADIUS Access-Accept

Port Authorized

EAPOL-Logoff

Port Unauthorized 101228

If IEEE 802.1x authentication times out while waiting for an EAPOL message exchange and MAC authentication bypass is enabled, the switch can authorize the client when the switch detects an Ethernet packet from the client. The switch uses the MAC address of the client as its identity and includes this information in the RADIUS-access/request frame that is sent to the RADIUS server. After the server sends the switch the RADIUS-access/accept frame (authorization is successful), the port becomes authorized. If authorization fails and a guest VLAN is specified, the switch assigns the port to the guest VLAN. If the switch detects an EAPOL packet while waiting for an Ethernet packet, the switch stops the MAC authentication bypass process and stops IEEE 802.1x authentication.

Figure 10-4shows the message exchange during MAC authentication bypass.

Figure 10-4 Message Exchange During MAC Authentication Bypass

		Authentication
Client		server
		(RADIUS)
	Switch

EAPOL Request/Identity

EAPOL Request/Identity

EAPOL Request/Identity

Ethernet packet

RADIUS Access/Request

RADIUS Access/Accept

141681

Catalyst 3750-E and 3560-E Switch Software Configuration Guide

10-6 OL-9775-02