HP V1910 manual EAP relay, Packet exchange method Benefits Limitations, 325

Packet exchange method Benefits Limitations

EAP termination	Works with any RADIUS server that
	supports PAP or CHAP authentication.

∙Supports only MD5-Challenge EAP authentication and the "username + password" EAP authentication initiated by an iNode 802.1X client.

∙The processing is complex on the network access device.

EAP relay

a shows the basic 802.1X authentication procedure in EAP relay mode, assuming that EAP-MD5 is used.

a.802.1X authentication procedure in EAP relay mode

Client	Device	Authentication server
	EAPOL	EAPOR
	(1) EAPOL-Start
	(2) EAP-Request/Identity
	(3) EAP-Response/Identity	(4) RADIUS Access-Request
		(EAP-Response/Identity)

(5)RADIUS Access-Challenge (EAP-Request/MD5 challenge)

(6) EAP-Request/MD5 challenge

(7) EAP-Response/MD5 challenge (8) RADIUS Access-Request(EAP-Response/MD5 challenge)

(9)RADIUS Access-Accept (EAP-Success)

(10) EAP-Success

Port authorized

(11)EAP-Request/Identity

(12)EAP-Response/Identity

...

(13)EAPOL-Logoff

Port unauthorized

(14) EAP-Failure

Table 97 When a user launches the 802.1X client software and enters a registered username and password, the 802.1X client software sends an EAPOL-Start packet to the network access device.

Table 98 The network access device responds with an Identity EAP-Request packet to ask for the client username.

Table 99 In response to the Identity EAP-Request packet, the client sends the username in an Identity EAP-Response packet to the network access device.

325