beautypg.com

Interlogix NS3550-2T-8S User Manual User Manual

Page 235

background image

IFS NS3552-8P-2S AND NS3550-2T-8S User Manual

235

Switch (802.1X device)—controls the physical access to the network based on the authentication status of the client.

The switch acts as an intermediary (proxy) between the client and the authentication server, requesting identity

information from the client, verifying that information with the authentication server, and relaying a response to the client.

The switch includes the RADIUS client, which is responsible for encapsulating and decapsulating the Extensible

Authentication Protocol (EAP) frames and interacting with the authentication server. When the switch receives EAPOL

frames and relays them to the authentication server, the Ethernet header is stripped and the remaining EAP frame is

re-encapsulated in the RADIUS format. The EAP frames are not modified or examined during encapsulation, and the

authentication server must support EAP within the native frame format. When the switch receives frames from the

authentication server, the server's frame header is removed, leaving the EAP frame, which is then encapsulated for

Ethernet and sent to the client.

Authentication Initiation and Message Exchange

The switch or the client can initiate authentication. If you enable authentication on a port by using the dot1x port-control auto

interface configuration command, the switch must initiate authentication when it determines that the port link state transitions

from down to up. It then sends an EAP-request/identity frame to the client to request its identity (typically, the switch sends an

initial identity/request frame followed by one or more requests for authentication information). Upon receipt of the frame, the client

responds with an EAP-response/identity frame.

However, if during boot up, the client does not receive an EAP-request/identity frame from the switch, the client can initiate

authentication by sending an EAPOL-start frame, which prompts the switch to request the client's identity

If 802.1X is not enabled or supported on the network access device, any EAPOL frames from the
client are dropped. If the client does not receive an EAP-request/identity frame after three attempts
to start authentication, the client transmits frames as if the port was in the authorized state. A port in
the authorized state effectively means that the client has been successfully authenticated.

When the client supplies its identity, the switch begins its role as the intermediary, passing EAP frames between the client and the

authentication server until authentication succeeds or fails. If the authentication succeeds, the switch port becomes authorized.

The specific exchange of EAP frames depends on the authentication method being used. “

Figure 4-11-2

” shows a message

exchange initiated by the client using the One-Time-Password (OTP) authentication method with a RADIUS server.

This manual is related to the following products: