Huawei Quidway S5600 Series - Page 509

Operation Manual – 802.1x
Quidway S5600 Series Ethernet Switches-Release 1510 Chapter 1
802.1x Configuration
Huawei Technologies Proprietary
1-6
Message-authenticator field, otherwise the packet is regarded as invalid and is
discarded.
type=80 length=18 string...
17
d
0
12
Figure 1-7 The format of an Message-authenticator fiel
1.1.4 802.1x Authentication Procedure
A Quidway S5600 series switch can authenticate supplicant systems in EAP
terminating mode or EAP relay mode.
I. EAP relay mode
This mode is defined in 802.1x. In this mode, EAP-packets are encapsulated in higher
level protocol (such as EAPoR) packets to allow them successfully reach the
authentication server. This mode normally requires the RADIUS server to support the
two newly-added fields: the EAP-message field (with a value of 79) and the
Message-authenticator field (with a value of 80).
Four authentication ways, EAP-MD5, EAP-TLS (transport layer security), EAP-TTLS
and PEAP (protected extensible authentication protocol), are available for the EAP
relay mode.
z EAP-MD5 authenticates the supplicant system. The RADIUS server sends MD5
keys (contained in EAP-request/MD5 challenge packets) to the supplicant system,
which in turn encrypts the passwords using the MD5 keys.
z EAP-TLS authenticates both the supplicant system and the RADIUS server by
checking their security licenses to prevent data from being stolen.
z EAP-TTLS is the extended EAP-TLS. EAP-TLS implements bidirectional
authentication between the client and authentication server. EAP-TTLS transmit
message using a tunnel established using TLS.
z PEAP creates and uses TLS security channels to ensure data integrity and then
performs new EAP negotiations to verify supplicant systems.
Figure 1-8 describes the basic EAP-MD5 authentication procedure.