IEEE 802.1X Port-Based Authentication

The IEEE 802.1X standard defines a client-server-based access control and authentication protocol that restricts unauthorized devices from gaining access to a network through publicly accessible ports. The authentication server authenticates a client connects to a switch port before granting the available network services to the client.

802.1X allows only Extensible Authentication Protocol over LAN (EAPOL) traffic through the switch port which an unauthenticated client is connected to. Normal traffic can pass through the switch port after authentication is completed successfully.

With 802.1X port-based authentication, network devices have the following device roles:

Client (Supplicant)	The device (workstation) that requires access to the LAN. Responds to the requests from the switch. Must be running 802.1X-compliant client software.
Switch or Access Point (Authenticator)	Controls the physical access to the network based on the authentication status of the client. Acts as a proxy between the client and authentication server, which requests identity information from the client, verify the information with the authentication server, and relays the response to the client. It is responsible for the re-encapsulation of the EAP and RADIUS frames for communication with a client and an authentication server respectively.
Authentication Server	Performs the authentication of the client. It validates the identity of the client and notifies the switch or access point whether the client is authorized to access the network. Currently, the RADIUS security system with EAP extensions is the only supported authentication server.

Note: RADIUS is referred to as Remote Authentication Dial-In User Service.

The EAP Architecture

EAP is designed to run over any link layer and use any number of authentication methods.

IEEE 802.1X Authentication Message Exchange

Below describes a typical WLAN 802.1X authentication process:
1) A wireless client becomes active on the medium. After the IEEE 802.11 WLAN Probe Request/Response, Authentication, and Association processes, the access point forces the port into an unauthorized state, which only 802.1X traffic is forwarded.
2) The access point replies with an EAP-Request Identity message to the wireless client to obtain the client’s identity. The wireless client’s EAP-Response Identity message, which contains the client’s identity, is forwarded to the authentication server.
3) The authentication server authenticates the wireless client and sends an Access Accept (or Access Reject) message to the access point.
4) Upon receiving the Access Accept message, the access point relays the EAP-Success message to the wireless client and transitions the client’s port to an authorized state and normal traffic is forwarded.

Note: Below lists the sequence of establishing WLAN connectivity with 802.1X authentication:
Probe Request, Probe Response, Authentication, Association, 802.1X authentication…

When 802.1X is enabled, ports are authenticated before any other L2 or L3 features are enabled.

Note: 802.1X is also considered as an efficient and effective alternative solution to port security.

IEEE 802.11 Frame Types

IEEE 802.11 in the OSI Reference Model

The IEEE 802.11 architecture resides in the Data Link Media Access Control (MAC) sublayer and the Physical layer in the OSI reference model.

The Basic Service Set (BSS) and Extended Services Set (ESS) are the 2 available infrastructure modes of WLAN. Another mode of WLAN is ad-hoc mode.

Basic Service Set (BSS) is the basic building block of a WLAN. It is often being referred to as the coverage area of an access point. An access point acts as a master to control the wireless stations within a BSS. A BSS is identified by an SSID. The most basic BSS is Independent Basic Service Set (IBSS) or ad-hoc mode BSS, which comprised of 2 wireless clients; whereas the most basic infrastructure mode BSS is comprised of an access point and a wireless client.

The IEEE 802.11 WLAN specification defines various frame types than Ethernet for wireless communications, as well as managing and controlling wireless connections. The types of frames in the IEEE 802.11 specification are management, control, and data frames. Understanding the different IEEE 802.11 frame types is essential for analyzing and troubleshooting the operation of WLANs.

Every IEEE 802.11 WLAN frame contains the MAC addresses of the source and destination wireless stations, a Frame Control field that indicates the 802.11 protocol version, frame type, and various indicators (eg: whether WEP is enabled, power management is active, etc), a Sequence Control field, the frame body, and the Frame Check Sequence for error detection.

IEEE 802.11 Frame Format

The figure above shows the frame format of the IEEE 802.11 WLAN specification.
Below describes the subfields and flags in the Frame Control field:

Protocol Version	Indicates the version of the 802.11 protocol. A receiving station uses this value to determine whether it supports the version of the protocol of the received frame.
Type and Subtype	Determine the function of the frame – management, control, or data. The type and subtype fields for each frame type determine the specific function to perform.
To DS and From DS	Indicates whether the frame is destined to or exiting from the distributed system (DS). All frames of wireless stations that are associated with an access point (infrastructure mode) will have one of the DS bits set. The interpretation of the Address fields depends on the setting of these bits.
More Fragments	Indicates whether there are more subsequent fragments for a particular management or data frame are to follow. Control frames are not fragmented, hence this bit is always set to 0 for control frames.
Retry	Indicates whether the management or data frame is being retransmitted.
Power Management	Indicates whether the sending wireless station is in active or power-saving mode.
More Data	Used to inform a wireless station which is in power-saving mode that the access point has more frames to send to it. Also used by an access points to indicate that additional broadcast or multicast frames are to follow. This bit is only being used in management and data frames; hence this bit is always set to 0 for control frames.
Protected	Indicates whether encryption and authentication are used for the frame. Control frames may not be encrypted; hence this bit is always set to 0 for control frames.
Order	Indicates that all received data frames must be processed in sequence.

Below shows how to interpret the To DS and From DS bits:

	From DS = 0	From DS = 1
To DS = 0	All management, control, and data frames within an IBSS (ad-hoc).	Data frames arrived at a wireless station (from AP) in an infra. WLAN.
To DS = 1	Data frames transmitted from a wireless station (to AP) in an infra. WLAN.	Data frames on a wireless bridge (WDS, Wireless Distribution System).

The Duration/ID field is used in all control frames (except with the subtype of PS-Poll) to indicate the remaining duration needed to receive the next frame transmission.

Wireless stations may want to save battery power by turning off antennas. When the subtype is PS-Poll, it contains the association identity (AID) of the waking transmitting station, which indicates which BSS the station belongs to. Note: PS is referred to as Power Save.

An 802.11 frame may contain up to 4 Address fields. The general rule is that Address 1 indicates the receiver of a frame, Address 2 as the transmitter, and Address 3 for filtering by the receiver. Depends upon the type of frame, the 4 Address fields will contain a combination of the following address types:

BSS Identifier (BSSID)	Used to uniquely identify each BSS (WLAN). When the frame is from a wireless station in an infrastructure BSS, the BSSID is the MAC address of the access point; when the frame is from a wireless station in an IBSS (ad-hoc) mode, the BSSID is a locally administered MAC address generated with a 46-bit random number, and is generated by the wireless station that initiated the IBSS.
Source Address (SA)	Indicates the 48-bit MAC address of the source station that created and transmitted the frame (source of the transmission). Only 1 station can be the source of a frame.
Destination Address (DA)	Indicates the 48-bit MAC address of the destination station to receive the frame (recipient).
Transmitter Address (TA)	Indicates the 48-bit MAC address of the wireless interface that transmitted the frame onto the wireless medium. The TA is only being used in wireless bridging.
Receiver Address (RA)	Indicates the 48-bit MAC address of the (immediate) wireless station which should receive and process the frame. If it is a wireless station, the RA is the DA. For frames destined to a node on an Ethernet network connected to an access point, the RA is the wireless interface of the access point, and the DA may be a node attached to the Ethernet.

Below shows the usage of the Address fields in data frames:

Function	To DS	From DS	Address 1 (RX)	Address 2 (TX)	Address 3	Address 4
IBSS	0	0	DA	SA	BSSID	-
From AP	0	1	DA	BSSID	SA	-
To AP	1	0	BSSID	SA	DA	-
WDS	1	1	RA	TA	DA	SA

Note: Address 1 indicates the receiver; while Address 2 indicates the transmitter.

The Sequence Control field contains the following 2 subfields:

Fragment Number	Indicates the number of each frame of a fragmented upper-layer packet. The 1st fragment will have a fragment number of 0, and each subsequent fragment of a fragmented packet increments the fragment number incremented by one.
Sequence Number	Indicates the sequence number of each frame. It begins at 0 and incremented by 1 until 4095 and rollovers to zero and begins again (modulo-4096). All fragments of a fragmented packet as well as retransmitted frames will have the same sequence number.

Below lists the IEEE 802.11 management frames that allow wireless stations to establish and maintain communications:

Association Request	The 802.11 association process allows an access point to synchronize and allocate resources for a wireless adapter. A wireless adapter begins the process by sending an Association Request frame to an access point. Upon receiving the Association Request frame, the access point is considered associated with the wireless adapter and would allocate an association ID and resources for the wireless adapter. An Association Request frame contains information such as the SSID of the WLAN the wireless client wishes to associate with and the supported data rates.
Association Response	An access point would send an Association Response frame containing an acceptance or rejection notice to the wireless adapter requesting association. An Association Response frame contains information, eg: the association ID and the supported data rates.
Reassociation Request	When a wireless adapter roams away from its currently associated access point after found another access point with a stronger beacon signal, the wireless adapter would send a Reassociation Request frame to the new access point. The new access point would then coordinate with the previous access point to forward the data frames meant for the wireless adapter that may still be in the buffer of the previous access point.
Reassociation Response	An access point sends a Reassociation Response frame containing an acceptance or rejection notice to a wireless adapter requesting reassociation. Similar to the Association Response frame, the Reassociation Response frame contains information regarding an association – the association ID and the supported data rates.
Probe Request	A wireless station sends a Probe Request frame when it would like to obtain information of another wireless station. Ex: A wireless adapter sends a Probe Request frame to determine the access points that are within range.
Probe Response	A wireless station receives a Probe Request frame would respond with a Probe Response frame that contains capability information, eg: the supported data rates.
Beacon	An access point sends Beacon frames periodically to announce its presence and the services if offers using SSID, timestamp, and other access point parameters to wireless adapters that are within range. Wireless adapters continuously scan all 802.11 radio channels for beacon frames to choose the best access point to associate with. Beacon frames are also used to logically separate WLANs.
Disassociation	A wireless station sends a Disassociation frame to another wireless station when it would like to terminate the association. Ex: A wireless adapter that is shutting down gracefully can send a Disassociation frame to notify its associated access point that it is powering off. The access point can then remove the wireless adapter from the association table and release the allocated memory resources.
Authentication	The 802.11 authentication process is where an access point accepts or rejects the identity of a wireless adapter. A wireless adapter begins the process by sending an Authentication frame that contains its identity to the access point. For open authentication, the access point responds with an Authentication frame as a response to indicate the acceptance or rejection; while for shared-key authentication, the access point responds with an Authentication frame containing challenge text, which the wireless client must response with an Authentication frame containing the encrypted version of the challenge text using the shared-key for the access point to verify its identity. WLAN authentication occurs at L2 and is authenticating devices instead of users. The authentication and association processes are occurred in sequence. Note: Authentication occurs first and then followed by association.
Deauthentication	A wireless station sends a Deauthentication frame to another wireless station in order to terminate a secure connection.

Below lists the IEEE 802.11 control frames that assist the delivery of data frames between wireless stations:

Request to Send (RTS)	A station sends a RTS frame to another station as the 1st phase of the necessary 2-way handshake before transmitting a data frame.
Clear to Send (CTS)	A station response to a RTS frame with the CTS frame to provide the clearance for the source station to transmit a data frame. The CTS frame contains a time value which would cause all nearby stations (including hidden stations) to hold off data transmission for a certain period of time necessary for the source station to transmit its frames.
Acknowledgement (ACK)	A destination station would run an error checking process to detect the presence of errors upon received a data frame. The destination station would send an ACK frame to the source station if no errors are found. The source station will retransmit the frame if it doesn’t receive an ACK for the frame for a certain period of time.

Finally, data frames are used to carry upper layers data – packets.

Below shows the wireless client association process:
i) Access points send out beacons announcing the SSID and supported data rates.
ii) A wireless client scans all changes and sends out Probe Request frames to all access points within range.
iii) All access points within range reply with a Probe Response frame, and the wireless client listens for the responses from the access points.
iv) The wireless client associates with the access point with the strongest signal. Authentication and other security information are sent to the access point.
v) The access point accepts the association request and associated with the wireless client.
Note: 802.1X authentication could occur straight after the association process is completed.

The maximum Ethernet frame size is 1518 bytes whereas a wireless frame could be as large as 2346 bytes. Usually the WLAN frame size is limited to 1518 bytes as WLANs are often connected to and communicating with wired Ethernet networks.

IEEE 802.11 Standards and Specifications

Below lists the IEEE 802.11 Standards / Specifications as well as their purpose:

IEEE 802.11a	54Mbps 5GHz standard.
IEEE 802.11b	Enhancements to 802.11 to support 5.5Mbps and 11Mbps.
IEEE 802.11c	Bridge operation procedures. Included in the IEEE 802.1d standard.
IEEE 802.11d	International (country-to-country) roaming extensions.
IEEE 802.11e	Enhancements to 802.11 – Quality of Service. Including packet bursting.
IEEE 802.11F	Inter-Access Point Protocol.
IEEE 802.11g	54Mbps 2.4GHz standard. Backward compatible with 802.11b.
IEEE 802.11h	Spectrum Managed 5GHz 802.11a – Dynamic Frequency Selection (DFS) and Transmit Power Control (TPC).
IEEE 802.11i	Wi-Fi Protected Access 2 (WPA2) for enhanced security (authentication and encryption). Also referred to as Robust Security Network (RSN).
IEEE 802.11j	Extensions for Japan and US public safety.
IEEE 802.11k	Enhancements to 802.11 – Radio Resource Management (RRM).
IEEE 802.11m	Maintenance of the standard, odds and ends.
IEEE 802.11n	Higher throughput improvements using Multiple Input, Multiple Output (MIMO) antennas.
IEEE 802.11p	Wireless Access for the Vehicular Environment (WAVE) for vehicular environments, eg: ambulances and passenger cars.
IEEE 802.11r	Fast roaming.
IEEE 802.11s	Extended Service Set (ESS) Mesh Networking.
IEEE 802.11T	Wireless Performance Prediction (WPP).
IEEE 802.11u	Internetworking with non-802 networks, eg: cellular networks.
IEEE 802.11v	Wireless network management.
IEEE 802.11w	Protected Management Frames.
IEEE 802.11y	3650–3700 operation in the US.
IEEE 802.11z	Extensions to Direct Link Setup (DLS).

The IEEE project naming convention uses upper-case letters (eg: 802.1Q) to identify standalone standards, and lower-case letters to identify amendments (previously known as supplements) to existing standards. There should never be 2 projects differing only in the case of letters!

The REV notation (eg: 802.1Q-REV) is used to identify a revision of an existing standard, which has more extensive changes to the existing standard than an amendment. Previously, revisions also had their own project names.