802.1x switches as intermediaries

Question

While viewing the documentation for configuring 802.1x on Cat Series switches; there is a statement to the effect that certain switches (Cat 2940 through Cat 3750) can be used as intermediaries. What does this really mean? Is this the edge switch itself as the intermediary between the client and the authentication server?Does it mean if I am using the Cat 4506, THEN I can use the intermediary switch between the 4506 and the client to "pass-through" the 802.1x request to the 4506? Surely this means that the intermediary switches cannot be used as the edge switch on their own?
I am assuming from the documentation that whatever switch is being used as the edge switch is the intermediary between the client and the authentication server.
Any enlightenment will be appreciated.
Diana

Answer 1

Q: Is this the edge switch itself as the intermediary between the client and the authentication server?
A: Yes
Q: Does it mean if I am using the Cat 4506, THEN I can use the intermediary switch between the 4506 and the client to "pass-through" the 802.1x request to the 4506?
A: Not necessarily. You can directly use Cat4500 as intermediary.
Q: Surely this means that the intermediary switches cannot be used as the edge switch on their own?
A: No, you can use them both as edge and intermediary.
For 802.1x, the intermediary devices can be Cat4000 series, Cat3550, Cat2950 or wireless AP. In other words, they are edge devices.
The intermediary here means that the device will act like a proxy or 'middle-man' between the client device requesting for access authentication (802.1x) and the authenication server, for example Cisco ACS server.
Basically, what happened is, the switch will request credential information from the client (i.e username/password), then forward the info to ACS server. ACS Server will check & verify the ID, and will respond with PASS or FAILED response to the switch. The switch, in turn, will grant or deny access to the client, based on the info/response.
http://www.cisco.com/en/US/products/hw/switches/ps628/products_configuration_guide_chapter09186a008007e8c4.html#xtocid2
http://www.cisco.com/en/US/products/hw/switches/ps663/products_configuration_guide_chapter09186a00800ddb0d.html#1133261
For NAC Layer2 + 802.1x, devices that can act as intermediaries are Cat6500 (depend on IOS ver), Cat4500, Cat3750, Cat3560, Cat3550, Cat2960/2970/2955/2950/2940, C7600 series router, Cisco Gigabit Ethernet Switching Module (CGESM) switches.
http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_configuration_guide09186a00805764fd.html#wp1202047
Hope this helps. Pls rate useful post(s).
AK