Cisco WS-C2980G-A Software Guide - Page 503

Chapter 31 Configuring 802.1x Authentication Understanding How 802.1x Authentication Works Table 31-1 802.1x Terminology Term Definition Authenticator PAE (Referred to as the "authenticator") entity at one end of a point-to-point LAN segment that enforces host authentication. The authenticator is independent of the actual authentication method and functions only as a pass-through for the authentication exchange. It communicates with the host, submits the information from the host to the authentication server, and authorizes the host when instructed to do so by the authentication server. Authentication server Entity that provides the authentication service for the authenticator PAE. It checks the credentials of the host PAE, and then notifies its client, the authenticator PAE, whether the host PAE is authorized to access the LAN/switch services. Authorized state Status of the port after the host PAE is authorized. Both Bidirectional flow control, incoming and outgoing, at an unauthorized switch port. Controlled port Secured access point. EAP EAPOL1 Extensible Authentication Protocol. Encapsulated EAP messages that can be handled directly by a LAN MAC service. In Flow control only on incoming frames in an unauthorized switch port. Port PAE2 Single point of attachment to the LAN infrastructure (for example, MAC bridge ports). Protocol object that is associated with a specific system port. PDU Protocol data unit. RADIUS Remote Access Dial In User Service. PAE (Referred to as the "host") entity that requests access to the LAN/switch services and responds to information requests from the authenticator. Unauthorized state Status of the port before the host PAE is authorized. Uncontrolled port Unsecured access point that allows the uncontrolled exchange of PDUs. 1. EAPOL = Extensible Authorization Protocol over LAN 2. PAE = Port access entity Authentication Server The frames exchanged between the authenticator and the authentication server are dependent on the authentication mechanism, so they are not defined by the 802.1x standard. You can use other protocols, but we recommend RADIUS for authentication, particularly when the authentication server is located remotely, because RADIUS has extensions that support encapsulation of EAP frames built into it. 78-15486-01 Catalyst 4500 Series, Catalyst 2948G, Catalyst 2980G Switches Software Configuration Guide-Release 8.1 31-5