802.1X端口认证：网络访问控制技术解析

4星 · 超过85%的资源需积分: 40 36 浏览量更新于2024-07-29 收藏 1.87MB PDF 举报

"802.1X端口认证是一种网络访问控制概念，它在设备被允许与网络上的其他设备通信之前对其进行评估。该技术通过扩展认证协议（EAP）在局域网（LAN）上运行，具体过程称为EAPOL（扩展认证协议在局域网上）。802.1X标准提供了对这一概念的应用及其对当今大多数计算机网络的影响的探讨。书中对基于端口的认证进行了入门级的概述，包括802.1X端口认证的描述、标准的历史和技术文档的发布详情，以及网络中的三个组件（客户端、认证设备和认证服务器）之间的连接细节。内容侧重于802.1X及其在网络实施中涉及的相关协议和组件的技术方面，特别是针对Cisco设备的深入讨论。书中的例子来源于802.1X的实际应用，并解决了在Cisco环境中遇到的故障排除问题。每章都包含主题概述，采用理论与实践相结合的方法，力求用易于理解的语言解释这个复杂的概念，并探讨了该网络协议在现代计算机网络中的各种应用。" 802.1X认证是网络安全领域的一个关键组成部分，它确保只有经过身份验证的设备才能接入网络。这种认证机制基于端口状态，未认证的设备只能与认证服务器通信，直到通过身份验证后才能完全访问网络资源。EAP（Extensible Authentication Protocol）是802.1X的核心，它允许使用多种不同的认证方法，如密码、智能卡或证书，以适应不同环境的安全需求。标准的发展历程和相关技术文档是理解802.1X的重要背景。这些文档定义了协议的规范，包括EAPOL，它规定了在以太网链路上如何传输EAP报文。网络的三个关键组件——客户端（通常是指网络设备，如PC或移动设备）、认证设备（通常是指交换机或接入点）和认证服务器（处理实际的身份验证过程）之间的交互是801.1X实施的关键部分。在实施802.1X时，必须考虑网络设计和配置，特别是在使用特定厂商设备（如Cisco）的情况下。书中的例子和故障排除指南有助于读者理解如何在实际环境中部署和维护802.1X。此外，书中还探讨了不同应用情况，展示了802.1X如何在今天的网络环境中提供安全保障，防止未经授权的设备接入，从而增强整体网络安全。通过遵循清晰的结构，先介绍主题，然后详细阐述，最后总结要点，本书旨在为读者提供全面的802.1X端口认证知识，无论他们是对网络技术有基础了解还是寻求更深入的理解。作者以技术专家的角度，结合理论与实践，使复杂的技术概念变得易于理解和应用。

OVERVIEW

Amazingly enough, the title of this chapter explains what it is all about. This

chapter is intended to provide a basic foundation in the subject of Port-

Based Authentication that will be sufﬁcient upon which to build a deeper

understanding. The way in which I will accomplish that is to provide three

sections in this chapter.

The ﬁrst section will contain what is anticipated in a ﬁrst section. It will

provide a fundamental description of 802.1X—Port-Based Authentication:

what it is, how it functions, and why it is important. The amount of detail is

minimal in this chapter. It is intended to ensure that a basic level set of

information has been established. Subsequent sections of the book will

provide most of the detailed information of how and why 802.1X functions

in a speciﬁc way in a given circumstance. This section identiﬁes the three

network components and the various protocols involved in an 802.1X

authentication.

The second section may seem a little out of place. It is a discussion of the

history of the standard and the technical documents published. Many books

will begin with the history before proceeding to a discussion of how it

works. I am not certain that the history of 802.1X is unique, and because of

the entities that were involved in the development of the standards, it

probably is not. The history of 802.1X is convoluted and complicated

because of the interactions of standards over time. The history involves at

least three distinct sets of standards and two organizations. Understanding

what is being developed at a particular point in time, and roughly how the

pieces ﬁt together, helps to clarify the current status of the standards. Also,

the history is so brief that both sides of technology implemented at an

evolutionary point in time are still present in many networks. Both pre- and

post-evolution changes in technology exist in current networks. This means

q 2006 by Taylor & Francis Group, LLC

that understanding when a particular product was created will imply certain

capabilities or the lack thereof in any given network.

The ﬁnal section in this chapter is really a bridge into the next chapter. It

provides the details of the connections among the three network com-

ponents. The various conversations that can take place in the authentication

process are diagramed. Detailed information is provided on what can occur

in each exchange and under what conditions.

1.1 WHAT IS 802.1X AND WHY SHOULD I CARE?

1.1.1 Section Summary

As this is the ﬁrst section of the book, it will provide the basic information

necessary to proceed to more complex subjects. So what is 802.1X? It is a

common belief that 802.1X is some kind of security. Some may think that it

is an authentication process employed when a device connects to a

network. There is also a conception that wireless authentication, and all

of the issues with secure communication over that medium, is 802.1X. All

of those beliefs are at least slightly inaccurate. Strictly speaking, 802.1X is a

language that extends the Extensible Authentication Protocol (EAP) over a

Local Area Network (LAN) through a process called Extensible Authentica-

tion Protocol Over LANs (EAPOL). This protocol is employed to transport

credential information between two devices. Thus, the actual deﬁnition in

the standards is much more limited than the commonly held beliefs. Rather

than attempt to enforce the stricter deﬁnition, I will use the term 802.1X

very loosely and allow the concept of 802.1X to be roughly equivalent to

Port-Based Authentication. Wherever a strict interpretation is required

during the course of this book, I will emphasize that situation.

Port-Based Authentication actually leverages three components to

accomplish its mission. 802.1X is probably the largest piece of the three,

but could not effectively function without the other two. Those other two

components are the Extensible Authentication Protocol-Methods (EAP-

Methods) and Remote Authentication Dial In User Service (RADIUS).

Again, 802.1X is the protocol employed to allow two devices to commu-

nicate. The protocol is called EAPOL. EAP-Methods is actually the data ﬁeld

of the protocol EAP, and EAPOL is a special case of EAP—which will be

discussed shortly.

802.1X is an extension of the IEEE 802 protocol and, as such, it operates at

Layer 2 of the Open System Interface (OSI) model. This is the Data Link Layer

and is present in both a wired and wireless LAN. 802.1X employs the protocol

EAPOL to prevent a device attempting to connect to a network from doing so

until it has provided credentials that can be validated. Credential information

is encapsulated in EAPOL by a device attempting to connect, and then sent to

another device that is part of the infrastructure of the network, usually a

switch or wireless access point. There, it is decapsulated and sent to a RADIUS

802.1X Port-Based Authentication

q 2006 by Taylor & Francis Group, LLC

server for validation. If successful, the RADIUS server tells the switch or access

point—and the device wishing access is allowed to fully connect. If the

validation is not successful, the switch or access point is notiﬁed, as well, and

no access is allowed.

Thus, there are three parties involved in the process. The ﬁrst is the

device wishing to connect, known as the Supplicant. The second device is

the one to which the Supplicant wishes to connect. This device is part of the

local network infrastructure and is known as the Authenticator. The third

device that houses the credential information is usually a RADIUS server and

is known as the Authentication Server. The Authenticator sits between the

Supplicant and the Authentication Server. No direct communication is ever

allowed between those two entities. The Authenticator is always the

recipient of any communication and always will repackage the content of

the communication before forwarding it. The Authenticator usually will not

be able to translate the content of credential exchanges, but must be able to

repackage the content from either the Supplicant or the Authentication

Server and forward it to the intended recipient. By inserting itself in the

process in this fashion, the Authenticator can guarantee that the Supplicant

cannot communicate with any other device.

EAPOL is a very simple protocol that is used only in Port-Based

authentication between an Authenticator and a Supplicant in an 802 LAN.

The basic communication consists of two types of packets. The Authenticator

sends Request-Identity packets to the Supplicant. The Supplicant sends

Response packets to the Authenticator. Based on notiﬁcation from RADIUS

concerning the validity of credentials supplied by the Supplicant, the

Authenticator will send either Success or Failure packets to the Supplicant.

There are a couple of additional types of packets that will be discussed, but

the basic protocol consists of these four types of packets.

The Port-Based Authentication process does venture into the realm of

Authorization to a certain extent because the VLAN in which a device is

placed is variable. The VLAN can be a Guest VLAN, the Authorized VLAN

associated with a port, or even a dynamic VLAN associated with the

credentials. The assignment of a VLAN within Port-Based Authentication

is very robust.

Why is this becoming more important in local networks? There are two

situations that are inﬂuencing this. First, electronic access to information is

becoming a basic function of many jobs, and, second, it is becoming more

common for attacks on networks and theft of information to occur. Port-

Based Authentication can be one mechanism employed to help both

situations. Port-Based Authentication can help ensure that only people

who are supposed to be on a network are the ones on it. This reduces

the population that must be inspected to a level that is at least controllable.

Yet, this is the ﬁrst level of security, not the only one that should be

implemented.

Overview

q 2006 by Taylor & Francis Group, LLC

1.1.2 What Is 802.1X in Detail?

The ﬁrst place to start is to discuss the term Port-Based Authentication. What

is Authentication and how does it differ from Authorization? Authentication

is the process of identiﬁcation. Frequently the process makes use of a

username/password combination. Authorization is the process of granting

certain privilege based on identity. Authentication provides assurance that a

person is who he or she claims to be, but says nothing about what access

should be granted. Thus, the process of ensuring that someone is who he

says he is must take place at a “port.” The port in question is a Layer 2

connection. In the wired environment, this is a physical port on a switch. In

a wireless environment, it is an “association” with an access point. The

implication of Port-Based Authentication is that a device attempting to

connect to a network will be challenged at the point of connection before

communication with any “authentic” devices already resident on the

network is allowed.

802.1X deﬁnes a set of protocols to support a methodology to answer the

question: Is this an authentic user or device that is allowed to connect to a

network? In the Section 1.1.1, this was identiﬁed as a Data Link Layer (Layer 2)

mechanism. Very simply, 802.1X is a Layer 2 protocol used to support the

determination of whether or not credentials supplied by a device wishing to

attach to a network are sufﬁcient to allow the connection.

From a physical perspective, 802.1X consists of three entities: a device

attempting to connect to a network, a second device that houses the desired

connection point, and a database containing credential information used to

validate the connection. These devices are called a Supplicant, an Authenti-

cator, and an Authentication Server, respectively. These names will change

somewhat depending on which particular speciﬁcation is referenced, but

these names are the commonly used terms. No matter what name is used the

functions are the same—a rose by any other name, so to speak. Figure 1.1

illustrates the three entities.

These three devices execute three different logical conversations to

conduct an authentication. Two of the conversations are physical exchanges

and can be seen in packet captures. These physical conversations are shown

in Figure 1.1. One conversation is entirely logical and cannot be seen in

Supplicant Authenticator Authentication

server

Figure 1.1 Basic 802.1X Communication.

802.1X Port-Based Authentication

q 2006 by Taylor & Francis Group, LLC

packet captures. The Supplicant and the Authenticator have a physical

conversation, and the Authenticator and the Authentication Server have a

physical conversation. Both of these conversations can be seen as data

transfers. The physical conversations actually support the exchange of

credential information between the Supplicant and the Authentication

Server. This is the entirely logical conversation. The key point here is that

the Supplicant can converse only with the Authenticator. Thus, the

Authenticator actually acts as a translator between the Supplicant and the

Authentication Server.

This means that there are several protocols implemented to support this

authentication system. Each of the conversations, either physical or logical,

must be supported by at least one distinct protocol. The three conversa-

tions—and all the protocols employed—are commonly called 802.1X; but,

in truth, only the physical conversation between the Authenticator and the

Supplicant is 802.1X—EAPOL. The physical communication between the

Authentication Server and the Authenticator is conducted using the RADIUS

protocol. The logical conversation between the Authentication Server and

the Supplicant is conducted using EAP and EAP-Methods.

What is EAP? EAP was created to be implemented in the Point-To-Point

(PPP) protocol. PPP is a protocol used for communication taking place on a

serial link—usually a leased telephone line. At ﬁrst glance, it would seem

that a serial protocol and a LAN protocol are entirely different animals and

would not have much in common. Generally, this is true. However, the

speciﬁcations for EAP are almost philosophical in nature and only require

the topology be a Point-to-Point connection. If you look at a single

connection on a switched LAN, or an association in wireless environments,

then you will see that they have strong Point-to-Point characteristics. Point-

to-Point characteristics are fundamental in the concept of EAP. As long as

those characteristics are present, then it is relatively simple to utilize EAP.

This can be accomplished with a Layer 2 encapsulation—EAPOL—in a

switched LAN. The result is 802.1X.

What is an EAP-Method then? An EAP-Method is the way in which a

particular authentication is conducted. In a sense, an EAP-Method is an

authentication. Parsing EAP-Method into EAP and Method makes it a little

easier to understand. It is a particular Method used to execute an

authentication utilizing EAP as a transport mechanism. EAP-Methods are

deﬁned for various ways to authenticate. There are many methods that have

been deﬁned. Some utilize certiﬁcates, others use Username/Password, and

some are methods of tunneling information between the Supplicant and the

Authentication Server. However diverse they become, each and every one

will always be encapsulated in EAP between the Supplicant and the

Authenticator.

EAP, again, is a protocol deﬁned to function within the PPP suite. 802.1X

leverages the topology of PPP and assumes a simple architecture of a single

device connecting to a single port on a network. A single Supplicant

Overview

q 2006 by Taylor & Francis Group, LLC

剩余244页未读，继续阅读

simboda

粉丝: 0

802.1X端口认证：网络访问控制技术解析

IEEE 802.1X-2004: Port-Based Network Access Control标准详解

IEEE 802.1X-2004：端口网络访问控制标准

IEEE 802.11x 标准详解：Port-Based网络访问控制

802.1X Port-Based Authentication.pdf

802.1X Port-Based Authentication HOWTO

Cisco - Configuring 802.1X Port-Based Authentication.rar

802.1x-2010标准（便宜1积分，内容都一样的）

802.1x协议培训胶片-20031008.pdf

dot1xCli_802.1x_802.1xdot1x_源码.zip

802.1x 配置

最新资源