To Next Page

To Previous Page

289

Portal support for EAP authentication process

Figure 92 Portal support for EAP authentication process

All portal authentication modes share the same EAP authentication steps. The following example

uses direct portal authentication to show the EAP authentication process:

1. The authentication client sends an EAP Request/Identity message to the portal server to initiate

an EAP authentication process.

2. The portal server sends a portal authentication request to the access device, and starts a timer

to wait for the portal authentication reply. The portal authentication request contains several

EAP-Message attributes, which are used to encapsulate the EAP packet sent from the

authentication client and carry the certificate information of the client.

3. After the access device receives the portal authentication request, it constructs a RADIUS

authentication request and sends it to the RADIUS server. The EAP-Message attributes in the

RADIUS authentication request are those carried in the received portal authentication request.

4. The access device sends a certificate request to the portal server according to the reply

received from the RADIUS server. The certificate request also contains several EAP-Message

attributes, which are used to transfer the certificate information of the RADIUS server. The

EAP-Message attributes in the certificate request are those carried in the RADIUS

authentication reply.

5. After receiving the certificate request, the portal server sends an EAP authentication reply to

the authentication client, carrying the EAP-Message attribute values.

6. The authentication client sends another EAP request to continue the EAP authentication with

the RADIUS server, during which there might be several portal authentication requests. The

subsequent authentication processes are the same as that initiated by the first EAP request,

except that the EAP request types vary with the EAP authentication phases.

7. After the authentication client passes the EAP authentication, the RADIUS server sends an

authentication reply to the access device. This reply carries the EAP-Success message in the

EAP-Message attribute.

8. The access device sends an authentication reply to the portal server. This reply carries the

EAP-Success message in the EAP-Message attribute.

9. The portal server notifies the authentication client of the authentication success.

HPE FlexNetwork MSR Series Comware 5 Security Configuration Guide

Other manuals for HPE FlexNetwork MSR Series