© UNIVERSITY of NEW HAMPSHIRE INTEROPERABILITY LABORATORY UNH InterOperability Laboratory Bridge Functions Consortium 802.1X Port-Based Network Access Control

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium IntroductionIntroduction 802.1X is a method to authenticate a new connection on a LAN. The Port-Based Authentication Protocol works with three parts. –Supplicant –Authenticator –Authentication Server 802.1X is a method to authenticate a new connection on a LAN. The Port-Based Authentication Protocol works with three parts. –Supplicant –Authenticator –Authentication Server

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium Terms and Definitions Authenticator - An entity at one end of a point-to-point LAN segment that facilitates authentication of the entity attached to the other end of that link. Authentication Server - An entity that provides an authentication service to an Authenticator. This service determines, from the credentials provided by the Supplicant, whether the Supplicant is authorized to access the services provided by the system in which the Authenticator resides. –Usually a Remote Authentication Dial In Service (RADIUS) Server Supplicant - An entity at one end of a point-to-point LAN segment that seeks to be authenticated by an Authenticator attached to the other end of that link. Authenticator - An entity at one end of a point-to-point LAN segment that facilitates authentication of the entity attached to the other end of that link. Authentication Server - An entity that provides an authentication service to an Authenticator. This service determines, from the credentials provided by the Supplicant, whether the Supplicant is authorized to access the services provided by the system in which the Authenticator resides. –Usually a Remote Authentication Dial In Service (RADIUS) Server Supplicant - An entity at one end of a point-to-point LAN segment that seeks to be authenticated by an Authenticator attached to the other end of that link.

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium How It Works - 1 The Supplicant supplies credentials to the Authenticator The supplicant does not have access to the Active Network right now. It can only communicate with the Authenticator The Supplicant supplies credentials to the Authenticator The supplicant does not have access to the Active Network right now. It can only communicate with the Authenticator

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium How It Works - 2 Since the Authenticator has access to the Authentication Server, it transmits the credentials over an encrypted communications.

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium How It Works - 3 If the credentials match what is stored in the Authentication Server’s database, the supplicant is allowed to connect to the LAN If the credentials do not match what is stored in the Authentication Server’s database, the supplicant is denied access to the LAN on all but the Physical Layer

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium SupplicantSupplicant The supplicant is a software program that runs on the Operating system of the computer that is trying to connect the LAN. What the supplicant supplies depends on the Authentication methods being used. The currently tested Authentication protocols are: –MD5-Challenge A Username, Password, and Domain are supplied. –PEAP A Username, Password, Domain, and certificate are supplied. –TTLS A Username, Password, Domain, and an Anonymous Username are supplied. The supplicant is a software program that runs on the Operating system of the computer that is trying to connect the LAN. What the supplicant supplies depends on the Authentication methods being used. The currently tested Authentication protocols are: –MD5-Challenge A Username, Password, and Domain are supplied. –PEAP A Username, Password, Domain, and certificate are supplied. –TTLS A Username, Password, Domain, and an Anonymous Username are supplied.

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium AuthenticatorAuthenticator The Authenticator is normally a switch equipped with the 802.1X protocols and the capability to talk to a RADIUS Server. The Authenticator has the IP address of the RADIUS Server in it as well as a Shared Secret between it and the Server. The Shared Secret allows it to tell the Server that it is in fact an Authenticator that is allowed to talk to it. The Authenticator also controls which ports support 802.1X. –Ports in which 802.1X is enabled are called Controlled Ports. –Ports in which 802.1X is disabled are called Uncontrolled Ports. Uncontrolled Ports do not require any Authentication and may access the LAN immediately. The Authenticator is normally a switch equipped with the 802.1X protocols and the capability to talk to a RADIUS Server. The Authenticator has the IP address of the RADIUS Server in it as well as a Shared Secret between it and the Server. The Shared Secret allows it to tell the Server that it is in fact an Authenticator that is allowed to talk to it. The Authenticator also controls which ports support 802.1X. –Ports in which 802.1X is enabled are called Controlled Ports. –Ports in which 802.1X is disabled are called Uncontrolled Ports. Uncontrolled Ports do not require any Authentication and may access the LAN immediately.

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium Authentication Server The Authentication Server is usually a RADIUS Server. Within the RADIUS Server there is a database of Usernames and Passwords, as well as a Server Certificate. Many RADIUS Servers also have a Certificate Authority Server on them, however it is not required. The RADIUS Server uses the Authentication Protocol(s) set by the user to be allowed on the LAN (i.e. MD5-Challenge, PEAP, TTLS) The Authentication Server is usually a RADIUS Server. Within the RADIUS Server there is a database of Usernames and Passwords, as well as a Server Certificate. Many RADIUS Servers also have a Certificate Authority Server on them, however it is not required. The RADIUS Server uses the Authentication Protocol(s) set by the user to be allowed on the LAN (i.e. MD5-Challenge, PEAP, TTLS)

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium Current Authentication Servers Microsoft Windows Server 2003 Standard Meetinghouse Aegis Radius Server Funk Steel-Belted-Radius Server Cisco Secure ACS Infoblox RADIUSOne FREERADIUS (To be added in the future)

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium Current Supplicants Microsoft Windows Built-in Client (2000/XP) Meetinghouse Aegis Client (2000/XP) Funk Odyssey Client (2000/XP) Xsupplicant (Linux, To be added in the future)

U NIVERSITY of N EW H AMPSHIRE I NTER O PERABILITY L ABORATORY UNH-IOL Bridge Functions Consortium Contact Information Tyler Marcotte, Curtis Simonson InterOperability Laboratory University of New Hampshire 121 Technology Drive Suite 2 Durham, NH (603) (603) (fax) Tyler Marcotte, Curtis Simonson InterOperability Laboratory University of New Hampshire 121 Technology Drive Suite 2 Durham, NH (603) (603) (fax)