Drag and Drop Question Match the terminology related to 802.1x authentication. Answer:

Question

Exhibit

Answer Area

Explanation

802.1X Authentication: Terminology Explained

The Framework

802.1X is a port-based Network Access Control (NAC) protocol with three defined roles. Understanding the who does what is the key to this question.

Item-by-Item Placement

1. Authenticator → AOS-CX Switch

The authenticator is the network access device (switch or wireless AP) that physically controls access to the network. It sits between the client and the rest of the network, blocking or allowing traffic based on authentication results.

• The AOS-CX switch fits because it's the gatekeeper - it receives the client's credentials but doesn't validate them itself; it forwards them upstream.
• Common mistake: Confusing the authenticator with the authentication server. The switch doesn't decide if you're allowed in - it only enforces the decision.

2. Authentication Server → HPE Aruba ClearPass

The authentication server is the backend system that actually validates credentials and returns an allow/deny decision.

• ClearPass is HPE Aruba's NAC/RADIUS server product - purpose-built for this role.
• It checks credentials against a user directory (e.g., Active Directory) and applies policy.
• Common mistake: Thinking the switch (authenticator) is the authentication server. The switch is just the enforcer; ClearPass is the decision-maker.

3. RADIUS → Encapsulated packets from NAS

RADIUS (Remote Authentication Dial-In User Service) is the protocol used to carry authentication data between the authenticator (the NAS - Network Access Server) and the authentication server.

• When the switch receives EAP credentials from the client over EAPoL, it re-encapsulates them inside RADIUS packets and forwards them to ClearPass.
• RADIUS is the transport layer between switch and server - not between the client and the switch.
• Common mistake: Thinking RADIUS runs all the way to the end client. It does not - the client speaks EAPoL, and the switch translates to RADIUS.

4. Supplicant → Windows Client

The supplicant is the end-user device requesting network access. It initiates the authentication process using EAP (Extensible Authentication Protocol) over LAN (EAPoL).

• The Windows client runs a built-in 802.1X supplicant and presents credentials (certificate, username/password, etc.) to the authenticator.
• Common mistake: Calling the client a "user" - 802.1X authenticates the device/machine (or user logged into the device), not just a person.

Traffic Flow Summary

Windows Client  --[EAPoL]-->  AOS-CX Switch  --[RADIUS]-->  ClearPass
  (Supplicant)               (Authenticator)              (Auth Server)
                                    <--- Policy Decision ---

The key mental model: EAPoL on the wire, RADIUS over the network, ClearPass makes the call, the switch enforces it.

No community discussion yet for this question.