Cisco Systems DOC-7814982 Authentication Initiation and Message Exchange

8-3
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 8 Configuri ng 802.1X Port-Bas ed Authenticat ion Understanding 802.1X Port-Based Authentication
Authentication Initiation and Message Exchange
The switch or the client can initiate authentication. If you enable authentication on a port by using the
dot1x port-control auto interf ace conf igur ation command, the swit ch must initi ate authen tication when
it determines that the port link state transitions from down to up. It then sends an EAP-request/identity
frame to the client to request its identity (typically, the switch sends an initial identity/request frame
followed by one or more requests for authentication information). Upon receipt of the frame, the client
responds with an EAP-response/identity frame.
However, if during bootup, the client does not receive an EAP-request/identity frame from the switch,
the client can initiate authentication by sending an EAPOL-start frame, which prompts the switch to
request the client’s identity.
Note If 802.1X is not ena bl ed or supported on the network acc ess device, any EAPOL fra mes from the cl i ent
are dropped. If the client does not receive an EAP-request/identity frame after three attempts to start
authentication, the client sends frames as if the port is in the authorized state. A port in the authorized
state e ff ecti vely means that th e client has been succ essfully auth enticated. For m ore inform ation, se e the
“Ports in Authorized and Unauthorized States” section on page 8-4.
When the client supplies its identity, the switch begins its role as the intermediary, passing EAP frames
between the client and the authentication server until authentication succeeds or fails. If the
authentication succeeds, the switch port becomes authorized. For more information, see the “Ports in
Author i zed an d U n au th oriz ed S ta tes ” sec tio n on pa ge 8-4.
The specific exch an ge of E A P fra me s d epend s o n th e au then t ica tion m e thod be ing use d. Figure 8-2
shows a message exchange initiated by the client using the One-Time-Password (OTP) authentication
method with a RADIUS server.
Figure 8-2 Message Exchan g e
Client Catalyst 2950 or 3550 switch
Port Authorized
Port Unauthorized
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/OTP
EAP-Response/OTP
EAP-Success
RADIUS Access-Request
RADIUS Access-Challenge
RADIUS Access-Request
RADIUS Access-Accept
EAPOL-Logoff
Authentication
server
(RADIUS)
74616