Overview of 802.1X Authentication

The IEEE802 LAN/WAN committee proposed the 802.1X protocol to solve the problem of wireless LAN network security. Later, the 802.1X protocol was widely used in Ethernet as a common access control mechanism for LAN ports, mainly to solve the problems of authentication and security in Ethernet. The 802.1X protocol is a port based network access control protocol. "Port-based network access control" means that, at the port level of the LAN access device, the access to the network resources is controlled through authentication for the connected user equipment. 802.1X Architecture The 802.1X system is a typical Client/Server structure, as shown in Figure 3, including three entities: Client, Device and Authentication server. Figure 3 802.1X Authentication System Architecture

• A client is an entity on a local area network that is authenticated by the device on the other end of the link. The client is generally a user terminal device, and the user can initiate 802.1X authentication by starting the client software. The client must support EAPOL (Extensible Authentication Protocol over LAN).
• The device side is another entity on the local area network that authenticates connected clients. The device side is usually a network device that supports the 802.1X protocol. It provides the client with a port to access the LAN. The port can be a physical port or a logical port.
• The authentication server is an entity that provides authentication services for the device. The authentication server is used for user authentication, authorization and accounting, usually a RADIUS (Remote Authentication Dial-In User Service) server.

802.1X Authentication Method The 802.1X authentication system uses EAP (Extensible Authentication Protocol) to realize the exchange of authentication information between the client, the device and the authentication server.

• Between the client and the device, the EAP protocol packets use the EAPOL encapsulation format and are directly carried in the LAN environment.
• There are two ways to exchange information between the device and the RADIUS server. One is that the EAP protocol packet is relayed by the device, and is carried in the RADIUS protocol using the EAPOR (EAP over RADIUS) encapsulation format; the other is that the EAP protocol packet is terminated by the device. Packets with the PAP (Password Authentication Protocol) or CHAP (Challenge Handshake Authentication Protocol) attribute interact with the RADIUS server for authentication.

802.1X Basic Concepts Controlled/Uncontrolled Port The device side provides a port for the client to access the LAN. This port is divided into two logical ports: a controlled port and an uncontrolled port. Any frame arriving at this port is visible on both controlled and uncontrolled ports.

• The uncontrolled port is always in a two-way connection state and is mainly used to transmit EAPOL protocol frames to ensure that the client can always send or receive authentication packets.
• The controlled port is in a bidirectional connection state in the authorized state and is used to transmit service packets; in the unauthorized state, it is forbidden to receive any packets from the client.

Authorized/Unauthorized Status The device uses the authentication server to authenticate the client that needs to access the LAN, and controls the authorization/unauthorized status of the controlled port according to the authentication result (Accept or Reject). Figure 4 Shows the effect of different authorization states on the controlled port on packets passing through this port. The figure compares the port status of two 802.1X authentication systems. The controlled port of system 1 is in an unauthorized state (equivalent to opening the port switch), and the controlled port of system 2 is in an authorized state (equivalent to closing the port switch). Figure 4 Effects of Authorization Status on Controlled Ports The user can control the authorization status of the port through the access control mode configured under the port. The port supports the following three access control modes:

• Forced authorization mode (authorized-force): indicates that the port is always in an authorized state, allowing users to access network resources without authorization.
• Force unauthorized mode unauthorized-force): Indicates that the port is always in an unauthorized state and does not allow users to authenticate. The device does not provide authentication services for clients accessing through this port.
• Auto-identification mode (auto): indicates that the initial state of the port is an unauthorized state, only EAPOL packets are allowed to send and receive, and users are not allowed to access network resources; If the authentication is passed, the port switches to the authorized state, allowing the user to access network resources. This is also the most common case.

Controlled Direction

In the unauthorized state, the controlled port can be set as one-way controlled and two-way controlled.

• When two-way control is implemented, the transmission and reception of frames are prohibited;
• When unidirectional control is implemented, receiving frames from the client is prohibited, but sending frames to the client is allowed.

Authentication process for 802.1X The 802.1X system supports EAP relay mode and EAP termination mode to interact with the remote RADIUS server to complete authentication. The following descriptions of the two authentication methods take the client's initiative to initiate authentication as an example.

EAP Relay Mode

This method is specified by the IEEE 802.1X standard, and EAP (Extensible Authentication Protocol) is carried in other high-level protocols, such as EAP over RADIUS, so that the extensible authentication protocol packets can reach the authentication server through complex networks. Generally speaking, the EAP relay mode requires the RADIUS server to support EAP attributes: EAP-Message and Message-Authenticator, which are used to encapsulate EAP packets and protect RADIUS packets carrying EAP-Message respectively. The following takes EAP-MD5 as an example to introduce the basic business process, as shown in Figure5 Figure5 IEEE 802.1X EAP relay business process of authentication system The authentication process is as follows:

• When the user needs to access the network, open the 802.1X client program, enter the username and password that have been applied and registered, and initiate a connection request (EAPOL-Start message).At this point, the client program will send a message requesting authentication to the device to start an authentication process.
• After receiving the data frame requesting authentication, the device will send a request frame (EAP-Request/Identity message) to request the user's client program to send the entered username.
• The client program responds to the request from the device and sends the username information to the device through a data frame (EAP-Response/Identity message). The device sends the data frame sent by the client through packet processing (RADIUS Access-Request message) to the authentication server for processing.
• After receiving the username information forwarded by the device, the RADIUS server compares the information with the username table in the database, finds the password information corresponding to the username, and encrypts it with a randomly generated encrypted word, and also send this encrypted word to the device through the RADIUS Access-Challenge message, and the device forwards it to the client program.
• After receiving the encrypted word (EAP-Request/MD5 Challenge message) from the device, the client program uses the encrypted word to encrypt the password part (this encryption algorithm is usually irreversible), generate an EAP-Response/MD5 Challenge packet, and send it to the authentication server through the device.
• The RADIUS server compares the received encrypted password information (RADIUS Access-Request message) with the local encrypted password information. If they are the same, the user is considered to be a legitimate user, and the authentication is passed. messages (RADIUS Access-Accept packets and EAP-Success packets).
• After receiving the authentication message, the device changes the port to the authorized state, allowing users to access the network through the port. During this period, the device will monitor the user's online status by periodically sending handshake messages to the client. By default, if the two handshake request packets are not answered by the client, the device will log the user offline, preventing the user from going offline due to abnormal reasons and the device cannot sense it.
• The client can also send an EAPOL-Logoff message to the device to actively request to log off. The device changes the port status from authorized to unauthorized, and sends an EAP-Failure packet to the client.

Configuring

• Enabling/disabling 802.1X Authentication Globally

SWITCH(config)# dot1x enable

SWITCH(config)#no dot1x enable

Enable and disable the 802.1X function globally.

SWITCH(config-if)# dot1x port-control auto

SWITCH(config-if)#no dot1x port-control auto

The port enables or disables the 802.1X function.

SWITCH(config)# radius-server host A.B.C.D auth-port <0-65535> acct-port <0-65535> key WORD

SWITCH(config)#no radius-server host A.B.C.D

Configure authentication server information. The default authentication port is 1812 and the accounting port is 1813. Please ensure that the RADIUS server and the device management address communicate with each other.

SWITCH(config-if)# dot1x protocol-version <1-2>

SWITCH(config-if)#no dot1x protocol-version

Configure the version number of the EAPOL protocol on the specified port. Optional configuration, default is 2.

SWITCH(config-if)# dot1x quiet-period <1-65535>

SWITCH(config-if)#no dot1x quiet-period

Configure the hold time of the HELD state. Optional configuration, the unit is seconds, the default is 60.

SWITCH(config-if)# dot1x reauthentication

SWITCH(config-if)#no dot1x reauthentication

The re-authentication function is enabled on the configuration port. Optional configuration, disabled by default.

SWITCH(config-if)# dot1x reauthMax <1-10>

SWITCH(config-if)#no dot1x reauthMax

Configure the maximum number of times for port re-authentication. If the number of re-authentication requests exceeds the limit and there is no response, the port becomes unauthorized. Optional configuration, default 2 times.

SWITCH(config-if)# dot1x keytxenabled { disable | enable}

Configure the port key transfer function. Optional, disabled by default.

SWITCH(config-if)# dot1x timeout {re-authperiod <1-4294967295> | server-timeout <1-65535> | supp-timeout <1-65535> | tx-period <1-65535>}

SWITCH(config-if)#no dot1x timeout {re-authperiod | server-timeout | supp-timeout | tx-period}

Configure the port timer time. Optional configuration, the default re-authentication period is 3600 seconds, the server timeout is 30 seconds, the client authentication timeout is 30 seconds, and the client request timeout is 30 seconds.

SWITCH(config)# mac-auth enable

SWITCH(config)#no mac-auth enable

Enable or disable the MAC authentication function globally.

SWITCH(config-if)# mac-auth {enable | disable}

The port enables or disables the MAC authentication function.

SWITCH(config-if)# mac-auth dynamic-vlan-creation {enable | disable}

The port enables or disables dynamic VLAN delivery of MAC authentication. The current version is not supported.

SWITCH(config-if)# mac-auth auth-fail-action {drop-traffic | restrict-vlan <2-4094>}

Configure the behavior of MAC authentication failure. Optional configuration, default is drop-traffic: drop traffic. The current version is not supported.

SWITCH(config)# radius-server deadtime <0-1440>

SWITCH(config)# no radius-server deadtime

Configure the RADIUS server death time.During the authentication process, the dead server will be automatically skipped, and the non-dead server will be selected for authentication. Optional configuration, the default is 0 minutes.

SWITCH(config)# radius-server key STRING

SWITCH(config)# no radius-server key

Configure the RADIUS server default key. Optional configuration.

SWITCH(config)# radius-server retransmit <1-100>

SWITCH(config)# no radius-server retransmit

Configure the RADIUS server retransmission times. Optional configuration, the default is 3 times.

SWITCH(config)# radius-server timeout <1- 60>

SWITCH(config)# no radius-server timeout

Configure the RADIUS server timeout period. Optional configuration, the default is 5 seconds.

Examples

802.1X Port Authentication Scenario ‏ • Requirement

• Requires authentication of access users on port GigabitEthernet0/3 to control their access to the Internet.
• RADIUS server group IP address 1.1.1.2.
• Set the shared key to be used when the system exchanges packets with the RADIUS server as name.

‏ • Network Diagram Figure 6 802.1X Typical network diagram for 802.1x authentication

• Typical configuration example

Device side:

SWITCH(config)#dot1x enable

SWITCH(config)#interface gigabitEthernet0/3

SWITCH(config-if)#dot1x port-control auto

SWITCH(config-if)#exit

SWITCH(config)#radius-server host 1.1.1.2 key name

Server: Configure NAS authentication device 1.1.1.1 and communication key name. Add user account test password test. The corresponding authentication method needs to be supported, such as EAP-MSCHAPv2 Client: Enable 802.1X authentication client and log in with account test. The corresponding authentication method needs to be supported, such as the EAP-MSCHAPv2 method.

MAC Authentication Scenario

‏ • Requirement

• Requires authentication of access users on port GigabitEthernet0/3 to control their access to the Internet.
• RADIUS server group IP address 1.1.1.2.
• Set the shared key when the system and the RADIUS server exchange messages as name.

‏ • Network Diagram Figure 7 Typical network diagram for MAC authentication

• Typical configuration example

Device side:

SWITCH(config)# mac-auth enable

SWITCH(config)#interface gigabitEthernet0/3

SWITCH(config-if)#mac-auth enable

SWITCH(config-if)#exit

SWITCH(config)#radius-server host 1.1.1.2 key name

Server: Configure NAS authentication device 1.1.1.1 and communication key name. Add the client MAC address as the user account and password to the user database. Client: Enable the 802.1X authentication client and log in with any account.

Display Information

• Show 802.1X Port Authentication Information

SWITCH#show dot1x all

802.1X Port-Based Authentication Enabled RADIUS server address: 1.1.1.2:1812 Next radius message id: 0 RADIUS client address: not configured 802.1X info for interface gigabitEthernet0/6 portEnabled: true – portControl: Auto portStatus: Unauthorized – currentId: 1 protocol version: 2 reAuthenticate: disabled reAuthPeriod: 3600 abort:F fail:F start:F timeout:F success:F PAE: state: Connecting – portMode: Auto PAE: reAuthCount: 1 – rxRespId: 0 PAE: quietPeriod: 60 – reauthMax: 2 – txPeriod: 30 BE: state: Idle – reqCount: 0 – idFromServer: 0 BE: suppTimeout: 30 – serverTimeout: 30 CD: adminControlledDirections: in – operControlledDirections: in CD: bridgeDetected: false KR: rxKey: false KT: keyAvailable: false – keyTxEnabled: false

SWITCH#show bridge

Bridge CVLAN SVLAN BVLAN Port MAC Address FWD Time-out ———+——+——+——+———–+– —————+—–+———+