CANOGA PERKINS 9175 Configuration Guide - Manual (Page 251)

CanogaOS Configuration Guide
39-2
and the authentication server must support EAP within the native frame format. When
the switch receives frames from the authentication server, the server’s frame header is
removed, leaving the EAP frame, which is then encapsulated for Ethernet and sent to the
client.
Port Access Entity (PAE)
The Port Access Entity (PAE) operates the Algorithms and Protocols associated with the
authentication mechanisms for a given Port of the System.
The Authenticator PAE controls the authorized/unauthorized state of its controlled Port
depending on the outcome of the authentication process.
Unidirectional and Bidirectional control
In the unauthorized state, the port can be set as unidirectional control or bidirectional
control.
In bidirectional state, the port does not allowed packet sending or receiving, while in the
unidirectional state, the port only discards incoming traffic.
39.4 Authentication Initiation and Message Exchange
The switch or the client can initiate authentication. If you enable authentication on a port
by using the dot1x port-control auto interface configuration command, the switch initiates
authentication when the link state changes from down to up or periodically as long as the
port remains up and unauthenticated. The switch sends an EAP-request/identity frame to
the client to request its identity. Upon receipt of the frame, the client responds with an
EAP-response/identity frame.
However, if during boot-up, the client does not receive an EAP-request/identity frame
from the switch, the client can initiate authentication by sending an EAPOL-start frame,
which prompts the switch to request the client identity.
When the client supplies its identity, the switch begins its role as the intermediary,
passing EAP frames between the client and the authentication server until authentication
succeeds or fails. If the authentication succeeds, the switch port becomes authorized.
The following figure shows a message exchange initiated by the client using the
One-Time-Password (OTP) authentication method with a RADIUS server.