Alcatel-Lucent 7750 - Figure 2: 802.1 X Authentication Scenario

Interface Configuration
7750 SR Interface Configuration Guide Page 45
Figure 2: 802.1x Authentication Scenario
The messages involved in the authentication procedure are illustrated in Figure 2. The router will
initiate the procedure when the Ethernet port becomes operationally up, by sending a special PDU
called EAP-Request/ID to the client. The client can also initiate the exchange by sending an
EAPOL-start PDU, if it doesn't receive the EAP-Request/ID frame during bootup. The client
responds on the EAP-Request/ID with a EAP-Response/ID frame, containing its identity
(typically username + password).
After receiving the EAP-Response/ID frame, the router will encapsulate the identity information
into a RADIUS AccessRequest packet, and send it off to the configured RADIUS server.
The RADIUS server checks the supplied credentials, and if approved will return an Access Accept
message to the router. The router notifies the client with an EAP-Success PDU and puts the port in
authorized state.
OSSG039
Client
EAPOL-Start
Access Request
Access Challenge
Access Request
Access Accept
quiet-period
EAP-Request/ID
EAP-Response/ID
EAP-Request/OTP
EAP-Response/OTP
EAP-Success
EAP-Logoff
EAP-Request/ID
Alcatel 7450 ESS RADIUS
Authentication
Server
Port Unauthorized
Port Unauthorized
Port Authorized
7750 SR