An authenticator is the network device that controls a protected connection between a supplicant and a network. In 802.1X port-based network access control, it keeps the connection locked until authentication succeeds, allowing only 802.1X traffic beforehand. section 11.4.3
802.1X separates access control into three roles:
- Supplicant: the client device requesting network access. section 11.4.3
- Authenticator: the network device to which the client connects, such as a switch or access point. section 11.4.3 section 20.2.2
- Authentication server: the server, usually RADIUS, that verifies the supplicant’s credentials. section 11.4.3
EAP provides authentication methods and message formats. EAPoL carries EAP messages between the supplicant and authenticator across Ethernet or 802.11, while RADIUS relays those messages between the authenticator and authentication server. In a split-MAC wireless design, the WLC acts as the authenticator and the AP tunnels client EAP messages to it through CAPWAP. section 20.2.2
Figure 11.8 An 802.1X-secured port only allows 802.1X traffic until the user has authenticated.
Use the access-state diagram to see that an 802.1X-secured port permits only authentication traffic before successful authentication. section 11.4.3
Figure 20.7 EAPoL is used to transport EAP messages between the supplicant and authenticator, and RADIUS between the authenticator and AS.
Use the message-flow diagram to distinguish EAPoL between the supplicant and authenticator from RADIUS between the authenticator and authentication server. section 20.2.2
