System and method for dynamically determining the role of a network device in a link authentication protocol exchange

1. A method comprising:

monitoring a plurality of link authentication protocol exchanges initiated between a first network device and a second network device, wherein

the first network device is an authenticator in a first one of the link authentication protocol exchanges and a supplicant in a second one of the link authentication protocol exchanges, wherein the first one of the link authentication protocol exchanges cannot complete unless the first network device has connectivity to an authentication server, wherein the link authentication protocol exchanges are extensible authentication protocol (EAP) exchanges, and wherein whether the first network device should be the authenticator or the supplicant is indeterminate, prior to initiation of the link authentication protocol exchanges;

detecting whether the first network device has connectivity with the authentication server; and

terminating one of the link authentication protocol exchanges prior to completion of the one of the link authentication protocol exchanges, wherein the terminating is performed in response to the detecting and wherein the monitoring, the detecting, and the terminating are performed by the first network device.

2. The method of claim 1 , wherein the link authentication protocol exchanges are initiated at the same time.

3. The method of claim 1 , wherein

the terminating comprises terminating participation of the first network device in one of the link authentication protocol exchanges.

4. The method of claim 1 , wherein the detecting comprises detecting receipt of a non-ID request from the second network device by the first network device.

5. The method of claim 1 , wherein the detecting comprises detecting receipt of a message from the authentication server by the first network device.

6. The method of claim 1 , further comprising

detecting that both the first network device and the second network device have connectivity with the authentication server; and

performing a tiebreaker function, in response to the detecting that both the first network device and the second network device have connectivity with the authentication sewer, wherein

the terminating is also performed in response to the performing the tiebreaker function.

7. The method of claim 6 , wherein

the performing the tiebreaker function comprises comparing a first identifier of the first network device with a second identifier of the second network device.

8. The method of claim 1 , wherein the link authentication protocol exchanges are IEEE 802.1X protocol exchanges.

9. The method of claim 1 , further comprising:

completing one of the link authentication protocol exchanges; and

authenticating an interface that is coupled to a link coupling the first network device to the second network device in response to the completing.

10. A network device comprising:

a computer readable storage medium storing program instructions executable to implement plurality of modules, wherein the plurality of modules comprising:

an authenticator module for a link authentication protocol;

a supplicant module for the link authentication protocol; and

a role determination module coupled to the authenticator module and the supplicant module, wherein

the role determination module is executed to:

monitor the authenticator module and the supplicant module during a plurality of link authentication protocol exchanges initiated between the network device and a second network device, wherein the link authentication protocol exchanges are extensible authentication protocol (EAP) exchanges;

detect whether the network device has connectivity with an authentication server; and

terminate operation of one of the authenticator module and the supplicant module in response to detection of whether the network device has connectivity with the authentication server, prior to completion of a link authentication exchange, between the network device and the second network device, being participated in by the one of the authenticator module and the supplicant module, wherein the authenticator module cannot complete link authentication exchanges unless the network device has connectivity to the authentication server, and wherein whether the network device should be an authenticator or a supplicant is indeterminate, prior to initiation of the link authentication protocol exchanges.

11. The network device of claim 10 , wherein

the role determination module is configured to detect receipt of a non-ID request by the supplicant module, and

the role determination module is configured to terminate operation of the authentication module in response to the non-ID request.

12. The network device of claim 10 , wherein

the role determination module is configured to detect receipt of a message from the authentication server by the authentication module, and

the role determination module is configured to terminate operation of the supplicant module in response to the message.

13. The network device of claim 10 , wherein the role determination module is configured to:

detect whether both the network device and the second network device have connectivity with the authentication server, and

perform a tiebreaker function in response to detection that both the network device and the second network device have connectivity with the authentication server, and

terminate operation of one of the authenticator module and the supplicant module in response to a result of the tiebreaker function.

14. A system comprising:

a plurality of network devices coupled by a plurality of links, wherein a first network device of the network devices comprises:

an authenticator module for a link authentication protocol;

a supplicant module for the link authentication protocol; and

a role determination module coupled to the authenticator module and the supplicant module, wherein the role determination module is configured to:

monitor the authenticator module and the supplicant module during a plurality of link authentication protocol exchanges initiated between the first network device and a second network device, wherein the link authentication protocol exchanges are extensible authentication protocol (EAP) exchanges,

detect whether the first network device or the second network device has connectivity with an authentication server, and

terminate, in response to detection of whether the first network device or the second network device has connectivity with the authentication server, operation of one of the authenticator module and the supplicant module, prior to completion of a link authentication exchange, between the first network device and the second network device, being participated in by the one of the authenticator module and the supplicant module, wherein the authenticator module cannot complete link authentication exchanges unless the first network device has connectivity to the authentication server, and wherein whether the first network device should be an authenticator or a supplicant is indeterminate, prior to initiation of the link authentication protocol exchanges.

15. The system of claim 14 , wherein

a first link of the links couples the first network device to the second network device of the network devices.

16. The system of claim 15 , wherein

the second network device comprises:

a second authenticator module for the link authentication protocol,

a second supplicant module for the link authentication protocol, and

a second role determination module coupled to the second authenticator module and to the second supplicant module.

17. The system of claim 14 , wherein

the role determination module is configured to detect receipt of a non-ID request from the second network device by the supplicant module, and

the role determination module is configured to terminate operation of the authentication module in response to the non-ID request.

18. The system of claim 14 , wherein

the role determination module is configured to detect receipt of a message from the authentication server by the authentication module, and

the role determination module is configured to terminate operation of the supplicant module in response to the message.

19. The system of claim 14 , wherein

the role determination module is configured to:

detect whether both the first network device and the second network device have connectivity with the authentication server, and

perform a tiebreaker function in response to detection that both the first network device and the second network device have connectivity with the authentication server, and

terminate operation of one of the authenticator module and the supplicant module in response to a result of the tiebreaker function.

20. A computer readable storage medium storing program instructions executable to:

monitor a plurality of link authentication protocol exchanges initiated between a first network device and a second network device, wherein

a first network device is an authenticator in a first one of the link authentication protocol exchanges and a supplicant in a second one of the link authentication protocol exchanges, and wherein the first one of the link authentication protocol exchanges cannot complete unless the first network device has connectivity to an authentication server, wherein the link authentication protocol exchanges are extensible authentication protocol (EAP) exchanges, and wherein whether the first network device should be an authenticator or a supplicant is indeterminate, prior to initiation of the link authentication protocol exchanges;

detect whether the first network device has connectivity with the authentication server; and

terminate one of the link authentication protocol exchanges prior to completion of the one of the link authentication protocol exchanges, in response to detection of whether the first network device has connectivity with the authentication server.

21. The computer readable storage medium of claim 20 , wherein the link authentication protocol exchanges are initiated at the same time.

22. The computer readable storage medium of claim 20 , wherein

terminating the one of the link authentication protocol exchanges comprises terminating participation of the first network device in the one of the link authentication protocol exchanges.

23. The computer readable storage medium of claim 20 , wherein

detecting whether the first network device has connectivity with the authentication server comprises detecting receipt of a non-ID request from the second network device by the first network device, and

terminating the one of the link authentication protocol exchanges comprises terminating the first one of the link authentication protocol exchanges.

24. The computer readable storage medium of claim 20 , wherein

detecting whether the first network device has connectivity with the authentication server comprises detecting receipt of a message from the authentication server by the first network device, and

terminating the one of the link authentication protocol exchanges comprises terminating the second one of the link authentication protocol exchanges.

25. The computer readable storage medium of claim 20 ,

wherein the program instructions are further executable to:

detect that both the first network device and a second network device have connectivity with the authentication server; and

perform a tiebreaker function, in response to detection that both the first network device and the second network device have connectivity with the authentication server, wherein the one of the link authentication protocol exchanges is terminated in response to the performing the tiebreaker function.

26. A system comprising:

means for monitoring a plurality of link authentication protocol exchanges initiated between a first network device and a second network device, wherein the first network device is an authenticator in a first one of the link authentication protocol exchanges and a supplicant in a second one of the link authentication protocol exchanges, and wherein the first one of the link authentication protocol exchanges cannot complete unless the first network device has connectivity to an authentication server, wherein the link authentication protocol exchanges are extensible authentication protocol (EAP) exchanges, and wherein whether the first network device should be an authenticator or a supplicant is indeterminate, prior to initiation of the link authentication protocol exchanges;

means for terminating one of the link authentication protocol exchanges prior to completion of the one of the link authentication protocol exchanges; and

means for detecting whether the first network device has connectivity with the authentication server, wherein the one of the link authentication protocol exchanges is terminated in response to the detecting.

27. The system of claim 26 , wherein the link authentication protocol exchanges are initiated at the same time.

28. The system of claim 26 , wherein

terminating the one of the link authentication protocol exchanges comprises terminating participation of the first network device in the one of the link authentication protocol exchanges.

29. The system of claim 26 , wherein

detecting whether the first network device has connectivity with the authentication server comprises detecting receipt of a non-ID request from the second network device by the first network device, and

terminating the one of the link authentication protocol exchanges comprises terminating the first one of the link authentication protocol exchanges.

30. The system of claim 26 , wherein

detecting whether the first network device has connectivity with the authentication server comprises detecting receipt of a message from the authentication server by the first network device, and

terminating the one of the link authentication protocol exchanges comprises terminating the second one of the link authentication protocol exchanges.

31. The system of claim 26 , further comprising:

means for detecting that both the first network device and the second network device have connectivity with the authentication server; and

means for performing a tiebreaker function, in response to the detecting that both the first network device and the second network device have connectivity with the authentication server, wherein

the one of the link authentication protocol exchanges is terminated in response to the performing the tiebreaker function.