The residential gateway normally acts as the 802.1X supplicant. It supplies identity information and participates in the Extensible Authentication Protocol exchange required to obtain network access. The access device or OLT commonly performs the authenticator role, controlling the subscriber-facing port and relaying authentication information between the supplicant and the authentication server. The authentication server, frequently using RADIUS, validates the credentials and returns an authorization result or related policy attributes. The gateway is therefore not itself the RADIUS database or authentication server in this design. A multicast querier performs a separate function by sending IGMP queries to maintain multicast membership information. Before successful authentication, the authenticator generally restricts ordinary subscriber traffic while allowing the authentication exchange required to complete access control.

==============