66
ï‚· Packet body: Content of the packet. When the EAPOL packet type is EAP-Packet, the Packet body
field contains an EAP packet.
EAP over RADIUS
RADIUS adds two attributes, EAP-Message and Message-Authenticator, for supporting EAP
authentication. For the RADIUS packet format, see the chapter ―AAA configuration.‖
EAP-Message
RADIUS encapsulates EAP packets in the EAP-Message attribute, as shown in Figure 27. The Type field
takes 79, and the Value field can be up to 253 bytes. If an EAP packet is longer than 253 bytes, RADIUS
encapsulates it in multiple EAP-Message attributes.
Figure 27 EAP-Message attribute format
0 15
Type String
7
Length
N
EAP packets
Message-Authenticator
RADIUS includes the Message-Authenticator attribute in all packets that have an EAP-Message attribute to
check their integrity. The packet receiver drops the packet if the calculated packet integrity checksum is
different than the Message-Authenticator attribute value. The Message-Authenticator prevents EAP
authentication packets from being tampered with during EAP authentication.
Figure 28 Message-Authenticator attribute format
0 2
Type String
1
Length
18 bytes
Initiating 802.1X authentication
Both the 802.1X client and the access device can initiate 802.1X authentication.
802.1X client as the initiator
The client sends an EAPOL-Start packet to the access device to initiate 802.1X authentication. The
destination MAC address of the packet can be the IEEE 802.1X specified multicast address 01-80-C2-00-
00-03 or the broadcast MAC address. If any intermediate device between the client and the
authentication server does not support this multicast address, you must use an 802.1X client, the iNode
802.1X client for example, that can send broadcast EAPOL_Start packets.
Access device as the initiator
The access device initiates authentication, if a client, the 802.1X client available with Windows XP for
example, cannot send EAPOL-Start packets.
The access device supports the following modes:
To Next Page
Loading...
Need help?
General