Ports In Authorized And Unauthorized States - Cisco 4500M Software Manual

Understanding 802.1X Port-Based Authentication
Figure 31-2 Message Exchange
Workstation

Ports in Authorized and Unauthorized States

The switch port state determines whether or not the client is granted access to the network. The port
starts in the unauthorized state. While in this state, the port disallows all ingress and egress traffic except
for 802.1X protocol packets. When a client is successfully authenticated, the port transitions to the
authorized state, allowing all traffic for the client to flow normally.
If a client that does not support 802.1X is connected to an unauthorized 802.1X port, the switch requests
the client's identity. In this situation, the client does not respond to the request, the port remains in the
unauthorized state, and the client is not granted access to the network. If the guest VLAN is configured
for a port that connects to a client that does not support 802.1X, the port is placed in the configured guest
VLAN and in the authorized state. For more information, see the
Guest VLANs" section on page
In contrast, when an 802.1X-enabled client connects to a port that is not running the 802.1X protocol,
the client initiates the authentication process by sending the EAPOL-start frame. When no response is
received, the client sends the request a fixed number of times. Because no response is received, the client
begins sending frames as if the port is in the authorized state.
You can control the port authorization state with the dot1x port-control interface configuration
command and these keywords:
•
•
Software Configuration Guide—Release 12.2(25)EW
31-4
Client
Catalyst 4500 Network
EAPOL-Start
EAP-Request/Identity
EAP-Response/Identity
EAP-Request/OTP
EAP-Response/OTP
EAP-Success
EAPOL-Logoff
Supplicant
force-authorized—Disables 802.1X authentication and causes the port to transition to the
authorized state without any authentication exchange required. The port transmits and receives
normal traffic without 802.1X-based authentication of the client. This setting is the default.
force-unauthorized—Causes the port to remain in the unauthorized state, ignoring all attempts by
the client to authenticate. The switch cannot provide authentication services to the client through the
interface.
Chapter 31 Understanding and Configuring 802.1X Port-Based Authentication
Access Switch
RADIUS Access-Request
RADIUS Access-Challenge
RADIUS Access-Request
RADIUS Access-Accept
Port Authorized
Port Unauthorized
Authenticator
31-6.
RADIUS
Authentication
server
"Using 802.1X Authentication for
OL-6696-01