All contents copyright (c) 2011 ZyXEL Communications Corporation.
48
supports the MD-5 challenge authentication mechanism, but will support the TLS
and TTLS in the future.
EAPOL Exchange between 802.1x Authenticator and Supplicant
The authenticator or supplicant can initiate the authentication. If you enable
the 802.1x authentication on the Wireless AP, the authenticator must initiate
authentication, when it determines that the Wireless link state transits from down to
up. It then sends an EAP-request/identity frame to the 802.1x client to request its
identity. (Typically, the authenticator sends an initial identity/request frame
followed by one or more requests for authentication information.) Upon the receipt
of frame, the supplicant responds with an EAP-response/identity frame.
However, if during boot-up, the supplicant does not receive an
EAP-request/identity frame from the Wireless AP, the client can initiate the
authentication by sending an EAPOL-Start frame, which prompts the switch to
request the supplicant’s identity. In above case, authenticator is co-located with
authentication server. When the supplicant supplies its identity, the authenticator
directly exchanges the EAPOL to the supplicant until the authentication succeeds or
fails. If the authentication succeeds, the port becomes authorized. If the
authentication fails, the port becomes unauthorized. When the supplicant does not
need the wireless access any more, it sends EAPOL-Logoff packet to terminate its
802.1x session and the port state will become unauthorized. The following figure
displays the EAPOL exchange ping-pong chart.
