Authenticate before admitting traffic
An endpoint acts as the supplicant and a switch or access point acts as the authenticator. The supplicant exchanges EAP messages over the local link using EAPOL. In a common deployment, the authenticator relays the EAP exchange to a RADIUS authentication server.
The uncontrolled port admits authentication and key management traffic while the controlled port is unavailable for ordinary access. The authenticator opens or assigns access according to policy after successful authentication. That decision controls admission. Protecting the contents of Ethernet frames requires a separate mechanism such as MACsec.
Try it in a lab
- Connect a supported supplicant to a lab authenticator and capture EAPOL. Confirm that the exchange can occur before ordinary data traffic is admitted.
- Compare a failed test authentication with a valid one. Observe the authenticator’s port authorization state and test normal traffic again after success.