Avaya C360 - IEEE 802.1 x (Port Based Network Access Control)

Avaya C360 Layer 2 Features
126 Installation and Configuration Guide Avaya C360 Multilayer Stackable Switches, version 4.5
IEEE 802.1x (Port Based Network Access Control)
Port Based Network Access Control (IEEE 802.1x) is a method for performing authentication to
obtain access to IEEE 802 LANs. The protocol defines an interaction between 3 entities:
● Supplicant - an entity at one end of a point-to-point LAN segment that is being
authenticated by an authenticator attached to the other end of that link.
● Authenticator - an entity at one end of a point-to-point LAN segment that facilitates
authentication of the entity attached to the other end of that link; in this case, the C360.
● Authentication (RADIUS) Server - an entity that provides an authentication service to an
authenticator. This service determines, from the credentials provided by the supplicant,
whether the supplicant is authorized to access the services provided by the authenticator.
The process begins with the supplicant trying to access a certain restricted network resource,
and upon successful authentication by the authentication server, the supplicant is granted
access to the network resources.
How 802.1x Authentication Works
802.1x provides a means of authenticating and authorizing users attached to a LAN port and of
preventing access to that port in cases where the authentication process fails. The
authentication procedure is port based, which means:
● access control is achieved by enforcing authentication on connected ports
● if an end-point station that connects to a port is not authorized, the port state is set to
"unauthorized" which closes the port to any traffic.
● As a result of an authentication attempt, the C360 port can be either in a "blocked" or a
"forwarding" state.
802.1x interacts with existing standards to perform its authentication operation. Specifically, it
makes use of Extensible Authentication Protocol (EAP) messages encapsulated within Ethernet
frames (EAPOL), and EAP over RADIUS for the communication between the Authenticator and
the Authentication Server.