802.1X authentication procedures

802.1X authentication has two methods: EAP relay and EAP termination. You choose either mode depending on support of the RADIUS server for EAP packets and EAP authentication methods.

• EAP relay mode.

  EAP relay is defined in IEEE 802.1X. In this mode, the network device uses EAPOR packets to send authentication information to the RADIUS server, as shown in Figure 35.

  Figure 34: EAP relay

In EAP relay mode, the client must use the same authentication method as the RADIUS server. On the access device, you only need to use the dot1x authentication-method eap command to enable EAP relay.

• EAP termination mode.

  As shown in Figure 36, the access device performs the following operations in EAP termination mode:

  1. Terminates the EAP packets received from the client.

  2. Encapsulates the client authentication information in standard RADIUS packets.

  3. Uses PAP or CHAP to authenticate to the RADIUS server.

  Figure 35: EAP termination