72
Using the Business Policy Switch 2000 Version 1.2
The following example illustrates how the BPS 2000, configured with the
EAPOL-based security feature, reacts to a new network connection:
•The switch detects a new connection on one of its ports.
—The switch requests a user ID from the new client.
—EAPOL encapsulates the user ID and forwards it to the RADIUS server.
—The RADIUS server responds with a request for the user’s password.
•The new client forwards an encrypted pass w ord to the switch, within the
EAPOL packet.
—The switch relays the EAPOL packet to the RA D IUS server.
—If the RADIUS server validates the passwor d, the new client is allowed
access to the switch and the network.
Some components and terms used with EAPOL-based security are:
•Supplicant—the device applying for access to the network.
•Authenticator—software with the sole purpose of authorizing a supplicant
that is attached to the other end of a LAN segment.
•Authentication Server—a RADIUS server that provides authorization
services to the Authenticator.
•Port Access Entity (PAE)—a software entity associated with each port that
supports the Authenticator or Supplicant functionality. In the preceding
example, the Authenticator PAE resides on the switch.
•Controlled Port—any switch port with EAPOL-based security enabled.
The Authenticator communicates with the Supplicant using an encapsulation
mechanism known as EAP over LANs (EAPOL).
The Authenticator PAE encapsulates the EAP message into a RADIUS packet
before sending the packet to the Authentication Server. The Authenticator
facilitates the authentication exchanges that occur between the Supplicant and the
Authentication Server by encapsulating the EAP message to make it suitable for
the packet’s destination.