Editing IEEE 802.1X (section)

==Overview==
[[Image:802.1X wired protocols.png|444px|thumb|right|EAP data is first encapsulated in EAPOL frames between the Supplicant and Authenticator, then re-encapsulated between the Authenticator and the Authentication server using RADIUS or [[Diameter (protocol)|Diameter]].]]
802.1X authentication involves three parties: a supplicant, an authenticator, and an authentication server. The '''[[Supplicant (computer)|supplicant]]''' is a [[Client (computing)|client]] device (such as a laptop) that wishes to attach to the LAN/WLAN. The term 'supplicant' is also used interchangeably to refer to the software running on the client that provides credentials to the authenticator. The '''[[authenticator]]''' is a network device that provides a data link between the client and the network and can allow or block network traffic between the two, such as an [[Network switch|Ethernet switch]] or [[wireless access point]]; and the '''authentication server''' is typically a trusted server that can receive and respond to requests for network access, and can tell the authenticator if the connection is to be allowed, and various settings that should apply to that client's connection or setting. Authentication servers typically run software supporting the [[RADIUS]] and [[Extensible Authentication Protocol|EAP]] protocols. In some cases, the authentication server software may be running on the authenticator hardware.

The authenticator acts like a security guard to a protected network. The supplicant (i.e., client device) is not allowed access through the authenticator to the protected side of the network until the supplicant's identity has been validated and authorized. With 802.1X port-based authentication, the supplicant must initially provide the required credentials to the authenticator - these will have been specified in advance by the network administrator and could include a user name/password or a permitted [[Public key certificate|digital certificate]]. The authenticator forwards these credentials to the authentication server to decide whether access is to be granted. If the authentication server determines the credentials are valid, it informs the authenticator, which in turn allows the supplicant (client device) to access resources located on the protected side of the network.<ref>{{cite web|title=802.1X Port-Based Authentication Concepts|url=http://www.wireless-nets.com/resources/downloads/802.1x_C2.html|access-date=2008-07-30|archive-url=https://web.archive.org/web/20121014224422/http://www.wireless-nets.com/resources/downloads/802.1x_C2.html|archive-date=2012-10-14}}</ref>