Cisco Systems WSC4500X16SFP Ports in Authorized and Unauthorized States

29-4
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter29 Understanding and Configuring 802.1X Port-Based Authentication
Understanding 802.1X Port-Based Authentication
Figure 29-2 Message Exchange
Ports in Authorized and Unauthorized States
The switch port state determines whether or not the client is granted access to the network. The port
starts in the unauthorized state. While in this state, the port disallows all ingress and egress traffic except
for 802.1X protocol packets. When a client is successfully authenticated, the port transitions to the
authorized state, allowing all traffic for the client to flow normally.
If a client that does not support 802.1X is connected to an una uthorized 802.1X port, the switch requests
the client’s identity. In this situation, the client does not respond to the request, the port remains in the
unauthorized state, and the client is not granted access to the network. If the guest VLAN is c onfigured
for a port that connects to a client that does not support 802.1X, the port is placed in the configured guest
VLAN and in the authorized state. For more information, see the “Using 802.1X Authentication for
Guest VLANs” section on page29-6.
In contrast, when an 802.1X-enabled client connects to a port that is not running the 802.1X protocol,
the client initiates the authentication process by sending the EAPOL-start frame. When no response is
received, the client sends the request a fixed number of time s. Because no response is received, the cli ent
begins sending frames as if the port is in the authorized state.
You can control the port authorization state with the dot1x port-control interface configuration
command and these keywords:
•force-authorized—Disables 802.1X authentication and causes the port to transition to the
authorized state without any authentication exchange required. The port transmits and receives
normal traffic without 802.1X-based authentication of the client. This setting is the default.
•force-unauthorized—Causes the port to remain in the unauthorized state, ignoring all attempts by
the client to authenticate. The switch cannot provide authentication services to the client through the
interface.
Port Authorized
Port Unauthorized
Authenticator
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/OTP
EAP-Response/OTP
EAP-Success
RADIUS Access-Request
RADIUS Access-Challenge
RADIUS Access-Request
RADIUS Access-Accept
EAPOL-Logoff
94159
Supplicant Authentication
server
Client
Workstation Catalyst 4500 Network
Access Switch RADIUS