802.1X Authentication Procedures; A Comparison Of Eap Relay And Eap Termination - HP 5500 HI Series Configuration Manual

Multicast trigger mode—The access device multicasts Identity EAP-Request packets periodically
•
(every 30 seconds by default) to initiate 802.1X authentication.
Unicast trigger mode—Upon receiving a frame with the source MAC address not in the MAC
•
address table, the access device sends an Identity EAP-Request packet out of the receiving port to
the unknown MAC address. It retransmits the packet if no response has been received within a
certain time interval.

802.1X authentication procedures

802.1X authentication has two approaches: EAP relay and EAP termination. You choose either mode
depending on the support of the RADIUS server for EAP packets and EAP authentication methods.
• EAP relay mode
EAP relay is defined in IEEE 802.1X. In this mode, the network device uses EAPoR packets to send
authentication information to the RADIUS server, as shown in
In EAP relay mode, the client must use the same authentication method as the RADIUS server. On the
network access device, you only need to execute the dot1x authentication-method eap command to
enable EAP relay.
Figure 25 EAP relay
• EAP termination mode
In EAP termination mode, the network access device terminates the EAP packets received from the
client, encapsulates the client authentication information in standard RADIUS packets, and uses
(Password Authentication Protocol) PAP or (Password Authentication Protocol) CHAP to
authenticate to the RADIUS server, as shown in
Figure 26 EAP termination

A comparison of EAP relay and EAP termination

Packet exchange method
EAP relay
Benefits
•
Supports various EAP
authentication methods.
•
The configuration and processing is
simple on the network access
device
68
Figure 25.
Figure 26.
Limitations
The RADIUS server must support the
EAP-Message and
Message-Authenticator attributes,
and the EAP authentication method
used by the client.