Canoga-perkins 9175 Configuration Guide Manual do Utilizador descarregar pdf (Página 252)

CanogaOS Configuration Guide

39-3

RADIUS

server

EAPOL

Client

EAPOR

EAPOL-Start

EAP-Request/identity

EAP-Response/identity

RADIUS Aceess-Request

RADIUS Aceess-challenge

EAP-Request/OTP

EAP-Response/OTP RADIUS Aceess-Request

RADIUS Aceess-AcceptEAPOL-Success

EAP-Request/identity

EAP-Response/identity

EAPOL-Logoff

Port authorized

Port unauthorized

Figure 39-1: 802.1x Protocol

39.5 Ports in Authorized and Unauthorized state

Depending on the switch port state, the switch can grant a client access to the network.

The port starts in the unauthorized state. While in this state, the port that disallows all

ingress traffic (default unidirectional control) except for IEEE 802.1x packets. When a

client is successfully authenticated, the port changes to the authorized state, allowing all

traffic for the client to flow normally.

If a client that does not support IEEE 802.1x connects to an unauthorized IEEE 802.1x

port, the switch requests the client’s identity. In this situation, the client does not respond

to the request, the port remains in the unauthorized state, and the client is not granted

access to the network.

In contrast, when an IEEE 802.1x-enabled client connects to a port that is not running

the IEEE 802.1x standard, the client initiates the authentication process by sending the

EAPOL-start frame. When no response is received, the client sends the request for a

fixed number of times. Because no response is received, the client begins sending

frames as if the port is in the authorized state.

You control the port authorization state by using the dot1x port-control interface

configuration command and these keywords:

1 2 ... 247 248 249 250 251 252 253 254 255 256 257 ... 279 280

Sem comentários

Canoga-perkins 9175 Configuration Guide Manual do Utilizador Página 252