L37
802.1X, EAP and switch access
Cram this first — memory hook
Supplicant asks; authenticator guards; authentication server decides. 802.1X is a standard, not port 8021.
Exam trap
A switch being the authenticator does not mean it necessarily stores and verifies every user's password locally.
The slide facts
Network access control can allow, block or restrict devices. 802.1X uses a supplicant, authenticator and authentication server, commonly Remote Authentication Dial-In User Service . Media Access Control filtering alone is insufficient.
If you have time — extra
Institute of Electrical and Electronics Engineers (IEEE) 802.1X is port-based network access control for wired and wireless access. The supplicant is the client seeking entry. The authenticator is the switch or access point that enforces the access decision. The authentication server commonly uses Remote Authentication Dial-In User Service (). Extensible Authentication Protocol () provides an authentication framework; the chosen method determines how identity is proved. over LAN () runs between the supplicant and authenticator; the authenticator commonly communicates with the server using . Network Access Control () is a broader policy concept that may also check device condition and put a device into a restricted network. Port security commonly limits identities on a switch port; those addresses can be spoofed, so this is not equivalent to strong user authentication.
Walkthrough
The device connects, exchanges with the authenticator, the authenticator relays the authentication exchange to the server, and the resulting decision controls normal or restricted access.