Cisco WS-X6K-SUP1A-PFC= Software Guide - Page 418

Understanding How Authentication Works Chapter 21 Configuring Switch Access Using AAA 802.1x controls network access by creating two distinct virtual access points at each port. One access point is an uncontrolled port; the other is a controlled port. All traffic through the single port is available to both access points. Only EAPOL traffic is allowed to pass through the uncontrolled port, which is always open. The controlled port is open only when the device connected to the port has been authorized by 802.1x. After this authorization takes place, the controlled port opens, allowing normal traffic to pass. Table 21-2 defines the terms used in 802.1x. Table 21-2 802.1x Terminology Term Definition Authenticator PAE (Referred to as the "authenticator") entity at one end of a point-to-point LAN segment that enforces supplicant authentication. The authenticator is independent of the actual authentication method and functions only as a pass-through for the authentication exchange. It communicates with the supplicant, submits the information from the supplicant to the authentication server, and authorizes the supplicant when instructed to do so by the authentication server. Authentication server Entity that provides the authentication service for the authenticator PAE. It checks the credentials of the supplicant PAE and then notifies its client, the authenticator PAE, whether the supplicant PAE is authorized to access the LAN/switch services. Authorized state Status of the port after the supplicant PAE is authorized. Both Bidirectional flow control, incoming and outgoing, at an unauthorized switch port. Controlled port Secured access point. EAP EAPOL1 Extensible Authentication Protocol. Encapsulated EAP messages that can be handled directly by a LAN MAC service. In Flow control only on incoming frames in an unauthorized switch port. Port PAE2 Single point of attachment to the LAN infrastructure (for example, MAC bridge ports). Protocol object associated with a specific system port. PDU Protocol data unit. RADIUS Remote Access Dial-In User Service. Supplicant PAE (Referred to as the "supplicant") entity that requests access to the LAN/switch services and responds to information requests from the authenticator. Unauthorized state Status of the port before the supplicant PAE is authorized. Uncontrolled port Unsecured access point that allows the uncontrolled exchange of PDUs. 1. EAPOL=Extensible Authorization Protocol over LAN 2. PAE=port access entity 21-8 Catalyst 6000 Family Software Configuration Guide-Releases 6.3 and 6.4 78-13315-02