Subject: [eap] Re: resolution to issue 161

From: Bernard Aboba <[email-masked]>
Date: Tue, 18 Nov 2003 14:07:10 -0800 (PST)

> Since the EAP peer/auth listener terms are used in the below text
> a number of times, do we need a definition for them?

Perhaps.  The intended meaning is roughly equivalent to the "Suppliant
PAE" and "Authenticator PAE" in 802.1x.

> >    Where the pass-through device implements an EAP peer listener,
> >    it will not forward to the backend authentication server
> >    EAP Request (Code=1), Success (Code=3) or Failure (Code=4)
> >    packets in order to act on them locally.  The use of the
> >    RADIUS protocol for encapsulation of EAP in pass-through
> >    operation is described in [RFC3579].
>
> I had to read the above paragraph a few times to understand
> what you are saying. So this is an EAP peer-side passthrough?
> Or an EAP passthrough authenticator with an EAP peer side to
> the other direction?

A pass-through device can act as an EAP peer as well as an authenticator.
For example, an AP could need to authenticate to a switch in order to be
allowed to connect to the wired network.  In this case, it will act
locally on any EAP-Requests it receives; it will never act as a
pass-through for Code=2 packets, regardless of whether the AAA protocol
supports peer pass-through or not.  This is because an EAP peer or
authenticator can only take one action on an EAP packet: act on it,
forward it, or drop it.  If it chooses to act on the packet, then it
cannot also forward it.

Does this help?

_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap