802.1x EAP Forwarding

[jrh]

I am trying to understand how the authenticator (switch in my situation) forwards the access-request message to AAA server.

If the EAP negotiation between supplicant and the authenticator takes place in the guest VLAN, how does that EAP info get forward out of that VLAN to the AAA server. Does the authenticator take the info from the EAP and create an access-request to send to AAA?

[Mike.Cifelli · Accepted solution]

An overview of the process:
EAPoL (extensible authentication protocol over LAN) is used for communication between your client (supplicant) and authenticator (NAD). Radius is then used between your NAD and your Radius device (ISE or something else). Your authenticator will send an eap-request identity once the supplicant sends an EAPoL start, and once the authenticator receives the EAP-response containing username info it then sends that info in a radius access-request. You can configure your NAD to send this traffic to your radius server with #ip radius source interface <>. See below pic for flow:

For more detail see here: https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec_1-99/Dot1X_Deployment/Dot1x_Dep_Guide.html

HTH!