8021x Doubt

lohit prasad — Mon, 11 Mar 2019 07:14:15 GMT

In 8021.x , Who starts first EAPOL message ? when we configure PC nd connect to switch ? switch once port comes up or once PC link comes up ??

When we configure PC to switch and authenticated by RADIUS sefvver now remove the PC from that port where it connected to switch and put it back wt will ahppen ? how reauthentications works ?

What are chances of Man in middle attak can happen

Hi,

Gagandeep Singh — Thu, 17 Nov 2016 10:10:10 GMT

Hi,

MDA requires that the device behind the phone successfully authenticate to gain access to the network. Because the data device is not directly connected to the switch, the switch cannot rely on link state to know when to start authenticating the data device. Therefore, the switch waits until it detects traffic from the second device (such as an EAPoL-Start from an IEEE 802.1X supplicant or DHCP or ARP traffic from a non-IEEE-802.1X-capable device), at which point it sends a unicast EAPoL Request packet to the device to initiate the authentication.

If the data device is not ready to or not capable of performing IEEE 802.lX, the switch will time out and continue to the next authentication method (e.g. MAB) and/or authorization type (e.g. Guest VLAN). If the device later becomes capable of performing IEEE 802.1X (e.g. because the operating system finished booting or a supplicant was manually enabled), then the data device should send an EAPoL-Start message to explicitly tell the switch to begin authentication.

Keep this document handy, will answer all your queries.

http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/config_guide_c17-605524.html#wp9000518

Regards

Gagan

rate if it helps!!!!

topic Hi, in Network Access Control

8021x Doubt

Hi,