CN101977147B - Message forwarding based new method for accessing NAT (Network Address Translation) router into 802.1X certification network - Google Patents

Abstract

The invention relates to the field of computer network communication, in particular to a message forwarding based new method for accessing an NAT (Network Address Translation) router into an 802.1X certification network, which comprises the steps of installing an 802.1X message forwarding module and a DHCP (Dynamic Host Configuration Protocol) message forwarding module on the NAT router; appointing an overlap network address to the external network port of the NAT router and an internal network host initiating a certification request; passing the 802.1X certification of the NAT router under the support of the message forwarding module and the certification client of the internal network host; and utilizing an IP (Internet Protocol) address by the internal protocol stack of the NAT router to solve the problem of address overlap. The new method has the advantages that the NAT router utilizes a certification client program of the internal network host to access various networks requiring 802.1X extension protocol certification and carry out NAT network extension; the new method has important reality significance and wide application prospects.

Description

A New Method for NAT Router Accessing 802.1X Authentication Network Based on Packet Forwarding

Technical field:

The invention relates to the field of computer network communication, in particular to a new method for a NAT router based on message forwarding to access an 802.1X authentication network.

Background technique:

The 802.1X (port-based network access control) authentication protocol is widely used in the broadband metropolitan area network and the campus network to control the access of network users to improve network security and facilitate network management.

As shown in Figure 1, the 802.1x authentication system includes three parts: the supplicant system (Supplicant System), the authentication system (AuthenticatorSystem) and the authentication server system (Authentication Server System). The supplicant PAE (port access entity) and the authenticator PAE, that is, the 802.1X authentication client of the user host and the authentication module of the switch, use the EAPOL protocol (Ethernet frame type is 0x888e) message interaction to complete the authentication process.

802.1X is usually combined with DHCP (Dynamic Host Configuration Protocol) to realize automatic allocation of IP addresses and reduce the workload of network administrators. According to the 802.1X standard, only after passing the authentication and authorization can the controlled port be opened and the DHCP client can be triggered to obtain network configuration. As shown in Figure 2, a typical authentication process is described as follows:

The network card of the user host is connected to the authentication switch port, and the 802.1X authentication client and DHCP client are installed on the host.

1. Certification process:

1. The 802.1X client sends an EAPOL-Start message to the authentication switch to start 802.1X authentication;

2. The authentication switch sends an EAP-Request/Identity message to the user host to request the user name;

3. The 802.1X client sends an EAP-Response/Identity message to the authentication switch, which contains the user name;

4. The authentication switch sends an EAP-Request/MD5-Challenge message to the user host to request a password;

5. The 802.1X client sends an EAP-Response/MD5-Challenge message to the authentication switch, which contains the password;

6. After passing the authentication, the authentication switch sends an EAP-Success message to the user host;

2. DHCP allocation process: At this time, the controlled port is opened and can transmit DHCP messages.

1. The DHCP client broadcasts a DHCP-Discover message to request DHCP services;

2. The DHCP server sends a DHCP-Offer message to the user host to provide an available network address;

3. The DHCP client sends a DHCP-Request message to the DHCP server to apply for a network address;

4. The DHCP server sends a DHCP-ACK message to the user host to confirm the network address allocation;

5. The DHCP client configures network parameters for the network port;

6. The 802.1X client of the user host prompts that it has successfully connected to the network.

3. Online maintenance: At this time, the user host has passed the authentication and has been connected to the network, and the authentication switch and the user host are regularly confirmed online.

1. The authentication switch sends an EAP-Request/Identity message to the user host;

2. The 802.1X client sends an EAP-Response/Identity packet to the authentication switch.

4. DHCP lease renewal: At this time, the user host address lease expires and requests renewal.

1. The DHCP client sends a DHCP-Request message to the DHCP server;

2. The DHCP server agrees to renew the lease and sends a DHCP-ACK message to the user host;

3. The DHCP client successfully renews the lease.

5. Disconnect from the network: At this time, the user host is ready to disconnect from the network service.

1. The DHCP client sends a DHCP-Release message to the DHCP server to release the IP address;

2. The 802.1X client sends an EAPOL-Logoff message to the authentication switch;

3. The authentication switch sends an EAP-Failure message to the user host;

4. The 802.1X client of the user host prompts that the logout is successful.

After being familiar with the above IEEE 802.1X authentication process, you can design an 802.1X client program for the NAT router, allowing it to act as a user host to access a network that requires 802.1X authentication. As shown in Figure 3, a NAT router uses network address translation technology to convert multiple internal IP addresses into one external IP address, and can provide network services for multiple hosts when IP addresses are limited.

However, not all network equipment is fully compliant with the IEEE 802.1X standard. In order to meet more requirements, network equipment manufacturers usually expand on the basis of the 802.1X standard protocol. Of course, these extended protocols still maintain the features defined by the standard, such as the part of the authentication message is an EAPOL type Ethernet frame, the EAPOL-Start message initiates an authentication request, and the EAP-Failure message indicates that the authentication fails. Their extension method is mainly to add client version information and host network configuration information at the end of the authentication message, or to design an online hold message with no EAP type defined. This essentially binds the authentication client, MAC address, and IP configuration information of the end user. Therefore, users can access the network only after installing a dedicated client program on the host computer and setting correct network configuration information.

It is obviously not feasible to install various dedicated authentication clients on NAT routers, because NAT routers are usually embedded devices, which are very different from ordinary desktop computer systems.

Invention content:

Therefore, the present invention proposes in view of the above-mentioned problems, and its purpose is to provide a kind of authentication client that makes NAT router utilize intranet host computer, be compatible with various 802.1X extension protocols, pass access authentication, and carry out the method for NAT network extension .

The overall architecture of the present invention is shown in Figure 4, including the following steps:

1. Design the 802.1X message forwarding module to solve the problem of the lack of dedicated authentication client for NAT routers.

The present invention includes an 802.1X message forwarding module, as shown in Fig. 5, by forwarding the EAPOL message of the host on the internal network, the NAT router is equipped with a PAE and passes 802.1X authentication.

The function of the 802.1X packet forwarding module is to forward the EAPOL packets of the internal network to the external network, and forward the EAPOL packets of the external network to the internal network. Its activation condition, in the case of static allocation of IP address and configuration information, is that the internal network host that matches the MAC address of the external network port initiates an authentication request; in the case of dynamic allocation of IP address and configuration information, it is any internal network When a host initiates an authentication request, it sends an EAPOL-Start packet; the termination condition is that the intranet host that initiates the authentication request receives an EAP-Failure packet.

When the 802.1X message forwarding module is activated, the EAPOL message received from the external network port needs to be forwarded unconditionally, and the basis for judging that an EAPOL message generated by the internal network needs to be forwarded is that its source MAC address is the one that initiated the authentication request. MAC address of the intranet host.

2. Design the DHCP message forwarding module to solve the problem of dynamic allocation of IP addresses.

The internal network host that initiates the authentication request must obtain an external network IP address, because the network configuration information may be attached to the keep-alive message. In the case of static allocation of IP addresses and configuration information, network configuration is done manually; however, in the case of dynamic allocation of IP addresses and configuration information, hosts on the internal network cannot request the DHCP service of the external network to obtain configuration information.

Therefore, the present invention also includes a DHCP message forwarding module. As shown in Figure 5.

The function of the DHCP message forwarding module is to forward the DHCP message of the internal network to the external network, and forward the DHCP message of the external network to the internal network. Its activation condition is that the IP address and configuration information are dynamically assigned and the intranet host that initiates the authentication request receives an EAP-Success packet, and the termination condition is that the intranet host that initiates the authentication request receives an EAP-Failure packet.

When the DHCP message forwarding module is activated, the DHCP message received from the external network port needs to be forwarded unconditionally; the basis for judging that a DHCP message generated by the internal network needs to be forwarded is that its source MAC address is the internal The MAC address of the network host.

When the 802.1X message forwarding module is activated, the intranet DHCP server will suspend the service of the intranet host that initiates the authentication request; when the 802.1X message forwarding module is terminated, the intranet DHCP server will resume the service of all intranet hosts .

3. Use overlapping addresses to solve the problem of logical port binding.

Passing 802.1X authentication does not mean that the physical port of the switch is fully opened. In engineering implementation, the switch port, MAC address and IP address are often bound, which is called "logical port binding".

In this case, through packet forwarding, only 802.1X access authentication can be passed, but the NAT router cannot be used to access the network, because the network configurations of its external network ports are different.

Therefore, the present invention also includes that the external network port of the NAT router and the internal network host that initiates the authentication request use overlapping network addresses, including MAC addresses, IP addresses and other configuration information.

In the case of static allocation of IP addresses and configuration information, before the authentication request is initiated, specify the MAC address, IP address and configuration information for the external network port of the NAT router. The intranet host that initiates the authentication request also sets the same network address.

In the case of dynamic allocation of IP addresses and configuration information, when the 802.1X message forwarding module is activated, the MAC address of the internal network host that initiates the authentication request is designated as the MAC address of the external network port of the NAT router. When the internal network host receives the DHCP-ACK message, it specifies the corresponding IP address and configuration information for the external network port of the NAT router.

4. Combining multiple methods to solve network access problems caused by overlapping addresses.

After adopting the overlapping address scheme, new network problems were created. For example, the network packet that should arrive at the intranet host with the overlapping address, because the destination address is the same as the external network port, will be obtained and discarded by the upper layer protocol stack of the NAT router; the intranet host with the overlapping address wants to communicate with the host and gateway of the same subnet , Send an ARP request on the intranet to ask for the MAC address, and there will be no response.

To solve the first problem, it is necessary to bind the protocol stack of the NAT router to the IP address of the internal network port instead of the IP address of the external network port, and assign the IP address of the external network port to the internal network host with the overlapping address.

To solve the second problem, proxy ARP needs to be used. Normally, a network port has an IP address, and it responds to an ARP request asking for the MAC address corresponding to the IP address. The meaning of proxy ARP is that the network port still responds with its own MAC address when it receives an ARP request that has nothing to do with all the hosts in the subnet. Afterwards, the intranet hosts with overlapping addresses can send IP packets and reach the correct location through the router. It can be seen from the meaning of proxy ARP that it will not affect the communication of the subnet where the network port is located.

The specific method is that after the external network port obtains a new network configuration, modify the routing table of the NAT router, forward the packet whose destination IP is the external network port IP to the internal network, and bind the internal network port IP address to the internally generated IP packet; Enable the proxy ARP of the internal network port to respond to the ARP request of the external network segment of the internal network host with overlapping addresses. As shown in Figure 4, the inside of the NAT router, the intranet host that initiates the authentication request, and other intranet hosts use the intranet port IP address, the IP address that overlaps with the external network port, and the common intranet IP address to initiate a network connection. Access to the network through the NAT (Network Address Translation) mechanism;

Adopting the method of the present invention has multiple benefits: the NAT router uses the authentication client of the intranet host to complete the authentication by forwarding messages, without the need for a built-in client program; as long as the authentication client program of the intranet host is changed, it can be accessed. Access to different 802.1X authentication networks; the entire authentication process is transparent to the intranet host that initiates the authentication, and does not require complex configuration on the client side, which is flexible and convenient.

Description of drawings:

Figure 1 is the IEEE 802.1X authentication system architecture diagram

Figure 2 is a typical 802.1X+DHCP access authentication sequence diagram

Figure 3 is a working diagram of a NAT router

Fig. 4 is the overall architecture diagram of the present invention

Fig. 5 is a schematic diagram of message forwarding involved in the present invention

Detailed ways:

In order to clearly illustrate the technical solutions of the present invention, the following examples are given in detail with reference to the accompanying drawings.

In a campus network, an extended 802.1X authentication protocol based on EAP-MD5 is adopted, and IP addresses are dynamically assigned by DHCP.

User hosts access the network through a NAT router, and the network structure is shown in Figure 3. The WAN port of the NAT router is connected to the authentication switch, and multiple LAN ports are connected to multiple user hosts; the intranet DHCP server of the NAT router assigns an intranet IP address to the user hosts connected to the LAN ports; 802.1X authentication clients are installed on the user hosts program.

1. Certification process:

1. The authentication client of one of the intranet hosts sends an EAPOL-Start message to the NAT router to initiate an authentication request;

2. The 802.1X packet forwarding module is activated. Designate the MAC address of the intranet host that initiated the authentication request as the MAC address of the external network port of the NAT router, and suspend the service of the intranet DHCP server for this MAC address;

3. The forwarding module forwards the EAPOL-Start message to the authentication switch;

4. The authentication switch sends an EAP-Request/Identity message to the NAT router, requesting a username;

5. The forwarding module forwards the EAP-Request/Identity message to the user host;

6. The authentication client sends an EAP-Response/Identity message to the NAT router, which contains the user name;

7. The forwarding module forwards the EAP-Response/Identity message to the authentication switch;

8. The authentication switch sends an EAP-Request/MD5-Challenge message to the NAT router to request a password;

9. The forwarding module forwards the EAP-Request/MD5-Challenge message to the user host;

10. The authentication client sends an EAP-Response/MD5-Challenge message to the NAT router, which contains the password;

11. The forwarding module forwards the EAP-Response/MD5-Challenge message to the authentication switch;

12. After the authentication is passed, the authentication switch sends an EAP-Success message to the NAT router;

13. The forwarding module forwards the EAP-Success message to the user host, and the DHCP forwarding module is activated;

2. DHCP allocation process: At this time, the controlled port is opened and can transmit DHCP messages.

1. The DHCP client broadcasts a DHCP-Discover message to request DHCP services;

2. The internal network DHCP server does not respond, and the forwarding module forwards the DHCP-Discover message to the external network;

3. The DHCP server sends a DHCP-Offer message to the NAT router to provide an available network address;

4. The forwarding module forwards the DHCP-Offer message to the user host;

5. The DHCP client sends a DHCP-Request message to the NAT router to apply for a network address;

6. The forwarding module forwards the DHCP-Request message to the DHCP server;

7. The DHCP server sends a DHCP-ACK message to the NAT router to confirm the network address allocation;

8. According to the DHCP-ACK message, set the IP address, subnet mask, default gateway, DNS server and other network parameters for the external network port of the NAT router;

9. Modify the routing table of the NAT router, forward the packet whose destination IP is the IP of the external network port to the internal network, and bind the internally generated IP packet to the IP address of the internal network port;

10. Enable the proxy ARP of the intranet port to respond to the ARP request of the external network segment of the intranet host with overlapping addresses;

11. The forwarding module forwards the DHCP-ACK message to the user host;

12. The DHCP client configures network parameters for the network port of the user host;

13. The 802.1X client of the user host prompts that it has successfully connected to the network;

14. The IP addresses of other intranet hosts remain unchanged, and the network can now be accessed through the NAT router.

3. Online maintenance: At this time, the NAT router has passed the authentication and has been connected to the network, and the authentication system and the NAT router will regularly confirm online.

1. The authentication system sends an EAP-Request/Identity message to the NAT router;

2. The forwarding module forwards the EAP-Request/Identity message to the user host;

3. The authentication client sends an EAP-Response/Identity message to the NAT router;

4. The forwarding module forwards the EAP-Response/Identity message to the authentication switch;

4. DHCP lease renewal

1. The DHCP client sends a DHCP-Request message to the NAT router;

2. The DHCP forwarding module forwards the DHCP-Request message to the DHCP server;

3. The DHCP server agrees to renew the lease and sends a DHCP-ACK message to the user host;

4. The DHCP forwarding module forwards the DHCP-ACK message to the user host;

5. The DHCP client successfully renews the lease.

5. Disconnect from the network: At this time, the NAT router is ready to disconnect from the network service.

1. The DHCP client sends a DHCP-Release message to the NAT router;

2. The forwarding module forwards the DHCP-Release message to the DHCP server;

3. The authentication client sends an EAPOL-Logoff message to the NAT router;

4. The forwarding module forwards the EAPOL-Logoff message to the authentication switch;

5. The authentication switch sends an EAP-Failure message to the NAT router;

6. The forwarding module forwards the EAP-Failure message to the user host;

7. The 802.1X message forwarding module and the DHCP message forwarding module are broken and terminated, and the service of the intranet DHCP server to all intranet hosts is restored;

8. The 802.1X client of the user host prompts that the logout is successful.

It should be noted that although the present invention has been described above with reference to specific embodiments, this is not meant to limit the present invention. Those skilled in the art should understand that various modifications and changes can be made to the present invention on the basis of the above description. Therefore, the protection scope of the present invention is defined by the appended claims rather than the specific embodiments.

Claims (4)

1. a kind of NAT router access 802.1X authentication network new method based on message forwarding, is characterized in that, comprises the steps: 1) 802.1X message forwarding module and DHCP message forwarding module are installed on the NAT router; wherein the function of the 802.1X message forwarding module is to forward the EAPOL message of the internal network to the external network, and send the EAPOL message of the external network to the external network. The activation condition of the 802.1X message forwarding module is: in the case of static allocation of IP address and configuration information, the internal network host matching the MAC address of the external network port initiates an authentication request, or the IP address and In the case of dynamic allocation of configuration information, any intranet host sends an EAPOL-Start message; the termination condition of the 802.1X message forwarding module is that the intranet host that initiates the authentication request receives the EAP-Failure message; and when When the 802.1X message forwarding module is activated, the EAPOL message received from the external network port needs to be forwarded unconditionally, and the source MAC address is the MAC address of the internal network host that initiates the authentication request. to forward; The function of the DHCP message forwarding module is to forward the DHCP message of the internal network to the external network, and forward the DHCP message of the external network to the internal network; the activation condition of the DHCP message forwarding module is an IP address and configuration information The intranet host that is dynamically allocated and initiates the authentication request receives the EAP-Success message, and the termination condition is that the intranet host that initiates the authentication request receives the EAP-Failure message; The DHCP message received by the network port needs to be forwarded unconditionally, and the DHCP message generated by the internal network is forwarded based on the source MAC address being the MAC address of the internal network host that initiated the authentication request; 2) Specify the same network address for the external network port of the NAT router and the internal network host that initiates the authentication request; 3) Use the IP address of the internal network port in the internal protocol stack of the NAT router, combined with routing correction, proxy ARP, and network address translation methods, to solve the problem of address overlap between the external network port and the internal network host; specifically, specifying the IP address for the external network port of the NAT router After the new IP address and configuration information, modify the routing table of the NAT router, forward the network packet whose destination IP address is the IP address of the external network port to the internal network, and bind the internal network port IP address to the IP packet generated by the internal protocol stack; Enable the proxy ARP of the intranet port to respond to the ARP request of the external network segment of the intranet host with overlapping addresses; inside the NAT router, the intranet host that initiates the authentication request, and other intranet hosts use the intranet port IP address and the external network respectively. The IP addresses with overlapping ports and common internal network IP addresses initiate network connections, and all access the network through the network address translation NAT mechanism. 2. The method according to claim 1, wherein said step 1) further comprises in the case of dynamic distribution of IP address and configuration information, when the 802.1X message forwarding module is activated, suspending intranet DHCP The service of the server to the intranet host that initiates the authentication request; when the 802.1X packet forwarding module is terminated, the service of the intranet DHCP server to all intranet hosts is resumed. 3. The method according to claim 1, characterized in that, said step 2) further comprises, in the case of static allocation of IP address and configuration information, before the authentication request is initiated, specifying the MAC address for the external network port of the NAT router address, IP address and configuration information; the intranet host that initiates the authentication request also sets the same network address. 4. The method according to claim 1, characterized in that, said step 2) further comprises, in the case of dynamic allocation of IP address and configuration information, when the 802.1X packet forwarding module is activated, authentication will be initiated The MAC address of the requested intranet host is designated as the MAC address of the external network port of the NAT router. When the intranet host that initiates the authentication request receives the DHCP-ACK message, it specifies the corresponding IP address and configuration information for the external network port of the NAT router. .

Images