Exploring IEEE 8021X
The IEEE 802.1 working group developed the 802.1X standard. It is a framework that addresses and provides port-based access control using authentication. Primarily, 802.1X is an encapsulation definition for EAP over IEEE 802 media. The Layer 2 protocol transports EAP authentication messages between a client device and a network device. 802.1X typically assumes a secure connection, and the enforcement of sessions are imposed through MAC-based filtering and port-start monitoring.
To provide further context on 802.1X theory, a few devices and processes must be explained:
• Supplicant. Device requesting access to the network. A supplicant represents a client, user, or PC.
• Authenticator. Network entry point device. This might be either a switch or wireless access point (AP). The authenticator enforces the security policy based on the results from authentication.
• Authentication server. Device that actually performs the supplicant's authentication. Based on results from authentication, the authentication server optionally provides the authenticator with a specific access-control policy to enforce. The simplest policy is to permit or deny the supplicant network access.
The basic identity concepts previously defined apply to the preceding devices. A supplicant needs to connect to a network. An authenticator's responsibility is to provide authenticated access and enforce policies. Then, an authentication server verifies the supplicant's identified credentials and instructs an authenticator on an initial service to provide.
802.1X specifies a protocol framework for authenticating a device that is connected to a port. When a host connects to the LAN port on a switch, the host's authenticity is determined by the switch port according to the protocol that 802.1X specifies. Assume that this is done before any other services offered by the switch are made available on that port. Until the authentication is complete, only EAPOL control frames can be processed on a port. No data plane traffic is typically allowed until the port is authorized. Figure 17-2 illustrates this model.
Figure 17-2 Port-Based Access Control with 802.1X
Figure 17-2 Port-Based Access Control with 802.1X
Figure 17-2 shows the operation of port-based access control and the effect of creating two distinct points of access to an authenticator's point of attachment to the LAN.
802.1X begins with a port of an authenticator disallowing network access at the port level. An initial EAP exchange (defined by RFC 3748) is then executed between the supplicant and authenticator. The EAP method is then negotiated or directly used between the supplicant and authentication server for the actual authentication. The EAP message is transported through 802.1X at the link layer to allow the supplicant and authenticator to converse.
Typically, RADIUS is used at the application layer to allow the authenticator to communicate with the authentication server. The actual authentication conversation is between the supplicant and authentication server via EAP, however. The authenticator is typically an EAP conduit and, ultimately, it enforces network policy, as Figure 17-3 shows.
As Figure 17-3 illustrates, RADIUS acts as the transport for EAP from the authenticator to the authentication server. (RFC 3579 provides a usage guideline for how RADIUS must support EAP between these devices.) RADIUS also carries back any policy instructions to an authenticator in the form of attribute-value pairs. (RFC 3580 provides usage guidelines for how 802.1X authenticators must use RADIUS.)
Figure 17-3 EAP with 802.1X and RADIUS
Port Unauthorized
' EAPOL-Start > EAP-Identity-Request _EAP-Identity-Response_EAP - Method DePendent
Port Unauthorized
' EAPOL-Start > EAP-Identity-Request _EAP-Identity-Response_EAP - Method DePendent
|
EAP-Auth-Exchange |
Auth Exchange with AAA Server ^ |
|
Authentication Successful/Rejected |
Port Authorized po!icy instructions
Port Unauthorized
EAPOL-Logoff
802.1X I I RADIUS
Port Authorized po!icy instructions
Port Unauthorized
EAPOL-Logoff
802.1X I I RADIUS
Continue reading here: Integration Value Add of 8021X
Was this article helpful?