The 802.1x authentication feature (Figure 7.14) for wireless LANs has three main components: the supplicant (usually the client software), the authenticator (usually the access point), and the authentication server (usually a remote authentication dial-in user service server, although RADIUS is not specifically required by 802.1x) [7]. The authenticator connects to the LAN network.

Figure 7.14: The 802.1x authentication feature. ( From [8]. 2003 Network World, Inc. Reprinted with permission.)

The normal flow for the 802.11x authentication process is as follows: The supplicant (in the client) tries to connect to the access point by sending a start message. The access point detects the supplicant and enables the supplicant's port in an unauthorized state, so only 802.1x/EAP messages are forwarded. All other traffic is blocked.

The supplicant then sends an EAP-start message. The access point replies with an EAP-request identity message to obtain the supplicant's identity. The client's EAP-response packet containing the supplicant's identity is forwarded to the authentication server.

The authentication server authenticates the supplicant and either responds by accepting or rejecting the supplicant. As the response is passed back through the authenticator, a passed authentication response will enable the port, whereas it remains blocked for a failed authentication response.