Cisco CISCO1401 Software Guide - Page 124
Sequence for EAP Authentication
![]() |
UPC - 746320202785
View all Cisco CISCO1401 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 124 highlights
Understanding Authentication Types Chapter 10 Configuring Authentication Types When you enable EAP on your bridges, authentication to the network occurs in the sequence shown in Figure 10-3: Figure 10-3 Sequence for EAP Authentication Switch on LAN 1 Non-Root Bridge Root Bridge Authentication server 1. Authentication request 2. Identity request 3. Username (Relay to server) (Relay to non-root bridge) 4. Authentication challenge 5. Authentication response (Relay to server) (Relay to non-root bridge) 6. Authentication success 7. Authentication challenge (Relay to server) (Relay to non-root bridge) 8. Authentication response 9. Authentication success (Relay to server) 88901 In Steps 1 through 9 in Figure 10-3, a non-root bridge and a RADIUS server on the wired LAN use 802.1x and EAP to perform a mutual authentication through the root bridge. The RADIUS server sends an authentication challenge to the non-root bridge. The non-root bridge uses a one-way encryption of the user-supplied password to generate a response to the challenge and sends that response to the RADIUS server. Using information from its user database, the RADIUS server creates its own response and compares that to the response from the non-root bridge. When the RADIUS server authenticates the non-root bridge, the process repeats in reverse, and the non-root bridge authenticates the RADIUS server. When mutual authentication is complete, the RADIUS server and the non-root bridge determine a WEP key that is unique to the non-root bridge and provides the non-root bridge with the appropriate level of network access, thereby approximating the level of security in a wired switched segment to an individual desktop. The non-root bridge loads this key and prepares to use it for the logon session. During the logon session, the RADIUS server encrypts and sends the WEP key, called a session key, over the wired LAN to the root bridge. The root bridge encrypts its broadcast key with the session key and sends the encrypted broadcast key to the non-root bridge, which uses the session key to decrypt it. The non-root bridge and the root bridge activate WEP and use the session and broadcast WEP keys for all communications during the remainder of the session. There is more than one type of EAP authentication, but the bridge behaves the same way for each type: it relays authentication messages from the wireless client device to the RADIUS server and from the RADIUS server to the wireless client device. See the "Assigning Authentication Types to an SSID" section on page 10-5 for instructions on setting up EAP on the bridge. 10-4 Cisco Aironet 1400 Series Wireless Bridges Software Configuration Guide OL-4059-01
![](/manual_guide/products/cisco-cisco1401-software-guide-337473e/124.png)