802.1X Fundamentals; 802.1X Architecture; Controlled/Uncontrolled Port And Port Authorization Status - HP A5830 Series Configuration Manual

802.1X fundamentals

802.1X is a port-based network access control protocol initially proposed by the IEEE 802 LAN/WAN
committee for securing WLANs. It has also been widely used on Ethernet networks for access control.
802.1X controls network access by authenticating the devices connected to 802.1X-enabled LAN ports.

802.1X architecture

802.1X operates in the client/server model. It comprises three entities: the client (the supplicant), the
network access device (the authenticator), and the authentication server. See
Figure 23 802.1X architecture
The client is a user terminal seeking access to the LAN. It must have 802.1X software to
•
authenticate to the network access device.
The network access device authenticates the client to control access to the LAN. In a typical 802.1X
•
environment, the network access device uses an authentication server to perform authentication.
The authentication server is the entity that provides authentication services for the network access
•
device. It authenticates 802.1X clients by using the data sent from the network access device, and
it returns the authentication results for the network access device to make access decisions. The
authentication server is typically a RADIUS server. In a small LAN, you can also use the network
access device as the authentication server.
Controlled/uncontrolled port and port authorization
status
802.1X defines two logical ports for the network access port: controlled port and uncontrolled port. Any
packet arriving at the network access port is visible to both logical ports.
The uncontrolled port is always open to receive and transmit EAPOL frames.
The controlled port is set in the authorized state if the client has passed authentication. It is set in the
unauthorized state if the client has failed authentication. See
In the authorized state, a controlled port allows incoming and outgoing traffic to pass through.
•
In the unauthorized state, a controlled port denies incoming and outgoing traffic in one of the
•
following ways:
Performs bidirectional traffic control to deny traffic to and from the client.
Performs unidirectional traffic control to deny traffic from the client.
The HP devices support only unidirectional traffic control.
Figure 24.
63
Figure 23.