Cisco IE 3000 Software Configuration Manual page 208
Hide thumbs
Also See for IE 3000:
- Hardware installation manual (186 pages) ,
- Getting started manual (32 pages) ,
- Software configuration manual (874 pages)
Table of Contents
Advertisement
Understanding IEEE 802.1x Port-Based Authentication
Figure 10-3
Client
If IEEE 802.1x authentication times out while waiting for an EAPOL message exchange and MAC
authentication bypass is enabled, the switch can authorize the client when the switch detects an Ethernet
packet from the client. The switch uses the MAC address of the client as its identity and includes this
information in the RADIUS-access/request frame that is sent to the RADIUS server. After the server
sends the switch the RADIUS-access/accept frame (authorization is successful), the port becomes
authorized. If authorization fails and a guest VLAN is specified, the switch assigns the port to the guest
VLAN. If the switch detects an EAPOL packet while waiting for an Ethernet packet, the switch stops
the MAC authentication bypass process and stops IEEE 802.1x authentication.
Figure 10-4
Figure 10-4
Client
Cisco IE 3000 Switch Software Configuration Guide
10-6
Message Exchange
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/OTP
EAP-Response/OTP
EAP-Success
Port Authorized
EAPOL-Logoff
Port Unauthorized
shows the message exchange during MAC authentication bypass.
Message Exchange During MAC Authentication Bypass
Switch
EAPOL Request/Identity
EAPOL Request/Identity
EAPOL Request/Identity
Ethernet packet
Chapter 10
Configuring IEEE 802.1x Port-Based Authentication
Authentication
(RADIUS)
RADIUS Access-Request
RADIUS Access-Challenge
RADIUS Access-Request
RADIUS Access-Accept
Authentication
server
(RADIUS)
RADIUS Access/Request
RADIUS Access/Accept
server
OL-13018-01
Advertisement
Chapters
Table of Contents
Troubleshooting
