802.1X is port-based network access control that keeps a switch port locked until the connecting device authenticates. Before authorization, only 802.1X authentication traffic passes; afterward, normal network access is permitted. section 11.4.3
The authentication exchange assigns three roles:
- Supplicant: the client device requesting network access. section 11.4.3
- Authenticator: the switch or other network device controlling access to the connected client. section 11.4.3 section 20.2.2
- Authentication server: the server, usually RADIUS, that verifies the supplicant’s credentials. section 11.4.3
- EAP supplies authentication methods and message formats; 802.1X carries EAP messages across Ethernet or 802.11 as EAPoL, while RADIUS relays them to the authentication server. section 20.2.2
Controlled switch-port access
A PC connected to switch SW1 cannot obtain ordinary network access immediately. SW1 acts as the authenticator, PC1 as the supplicant, and SRV1 as the authentication server; SW1 opens access only after PC1 authenticates. section 11.4.3
The same model applies to WPA-Enterprise wireless access. A client may associate with an access point yet remain unable to communicate until it completes 802.1X/EAP authentication; in split-MAC designs, the WLC can act as the authenticator. section 20.2.2
Figure 11.8 An 802.1X-secured port only allows 802.1X traffic until the user has authenticated.
Shows the traffic restriction on an 802.1X-secured port before authentication. section 11.4.3
Figure 20.7 EAPoL is used to transport EAP messages between the supplicant and authenticator, and RADIUS between the authenticator and AS.
Maps EAPoL between the client and authenticator to RADIUS between the authenticator and authentication server. section 20.2.2
