ZyXEL Communications VMG1312-B10A - IEEE 802.1 x; RADIUS

Appendix D Wireless LANs
VMG1312-B Series User’s Guide
342
IEEE 802.1x
I n June 2001, t he I EEE 802.1x st andard was designed t o ext end t he feat ures of I EEE 802.11 to
support extended aut henticat ion as well as providing additional accounting and cont rol feat ures. I t
is supported by Windows XP and a num ber of net work devices. Som e advantages of I EEE 802.1x
are:
• User based ident ificat ion t hat allows for roam ing.
• Support for RADI US ( Rem ot e Authent icat ion Dial I n User Service, RFC 2138, 2139) for
centralized user profile and account ing m anagem ent on a network RADI US server.
• Support for EAP (Ext ensible Authent icat ion Pr otocol, RFC 2486) that allows additional
aut hent icat ion m ethods t o be deployed wit h no changes to the access point or t he wireless
clients.
RADIUS
RADI US is based on a client- server m odel that support s authent icat ion, authorizat ion and
accounting. The access point is t he client and the server is the RADI US server. The RADI US server
handles t he following tasks:
• Authent icat ion
Determ ines the identit y of the users.
• Authorization
Determ ines the network services available t o aut hent icat ed users once they are connect ed to the
net work.
• Account ing
Keeps track of the client ’s network act ivity.
RADI US is a sim ple package exchange in which your AP acts as a m essage relay between the
wireless client and the network RADI US server.
Types of RADIUS Messages
The following t ypes of RADI US m essages are exchanged between t he access point and t he RADI US
server for user aut hent ication:
• Access-Request
Sent by an access point requesting aut hent icat ion.
• Access-Rej ect
Sent by a RADI US server rej ect ing access.
• Access-Accept
Sent by a RADI US server allowing access.
• Access-Challenge
Sent by a RADI US server requesting m ore inform at ion in order t o allow access. The access point
sends a proper response from t he user and then sends another Access- Request m essage.
The following t ypes of RADI US m essages are exchanged between t he access point and t he RADI US
server for user accounting: