802.1X commands 1

display dot1x· 1

display dot1x connection· 4

dot1x· 6

dot1x authentication-method· 7

dot1x auth-fail vlan· 8

dot1x critical vlan· 9

dot1x domain-delimiter 9

dot1x ead-assistant enable· 10

dot1x ead-assistant free-ip· 11

dot1x ead-assistant url 12

dot1x guest-vlan· 13

dot1x handshake· 13

dot1x handshake reply enable· 14

dot1x handshake secure· 15

dot1x mandatory-domain· 16

dot1x max-user 16

dot1x multicast-trigger 17

dot1x port-control 18

dot1x port-method· 18

dot1x quiet-period· 19

dot1x re-authenticate· 20

dot1x re-authenticate server-unreachable keep-online· 21

dot1x retry· 21

dot1x timer 22

dot1x unicast-trigger 24

reset dot1x guest-vlan· 25

reset dot1x statistics 25

 

display dot1x

Use display dot1x to display information about 802.1X.

Syntax

display dot1x [ sessions | statistics ] [ interface interface-type interface-number ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

sessions: Displays 802.1X session information.

statistics: Displays 802.1X statistics.

interface interface-type interface-number: Specifies a port by its type and number.

Usage guidelines

If you specify neither the sessions keyword nor the statistics keyword, the command displays all information about 802.1X, including session information, statistics, and configurations.

Examples

# Display all information about 802.1X.

<Sysname> display dot1x

Global 802.1X parameters:

   802.1X authentication  : Enabled

   CHAP authentication    : Enabled

   Max-tx period          : 30 s

   Handshake period       : 15 s

   Quiet timer            : Disabled

       Quiet period       : 60 s

   Supp timeout           : 30 s

   Server timeout         : 100 s

   Reauth period          : 3600 s

   Max auth requests      : 2

   EAD assistant function : Disabled

       EAD timeout        : 30 min

   Domain delimiter       : @

 Max 802.1X users         : 4294967295 per slot

 Online 802.1X users      : 0

 

FortyGigE1/1/1  is link-up

   802.1X authentication      : Enabled

   Handshake                  : Enabled

   Handshake reply            : Disabled

   Handshake security         : Disabled

   Unicast trigger            : Disabled

   Periodic reauth            : Disabled

   Port role                  : Authenticator

   Authorization mode         : Auto

   Port access control        : MAC-based

   Multicast trigger          : Enabled

   Mandatory auth domain      : Not configured

   Guest VLAN                 : Not configured

   Auth-Fail VLAN             : Not configured

   Critical VLAN              : Not configured

   Re-auth server-unreachable : Logoff

   Max online users           : 4294967295

 

   EAPOL packets: Tx 0, Rx 0

   Sent EAP Request/Identity packets : 0

        EAP Request/Challenge packets: 0

        EAP Success packets: 0

        EAP Failure packets: 0

   Received EAPOL Start packets : 0

            EAPOL LogOff packets: 0

            EAP Response/Identity packets : 0

            EAP Response/Challenge packets: 0

            Error packets: 0

   Online 802.1X users: 0

Table 1 Command output

Field	Description
Global 802.1X parameters	Global 802.1X configuration.
802.1X authentication	Whether 802.1X is enabled globally.
CHAP authentication	Performs EAP termination and uses CHAP to communicate with the RADIUS server. If EAP or PAP is enabled, this field is not available.
EAP authentication	Relays EAP packets and supports any of the EAP authentication methods to communicate with the RADIUS server. If CHAP or PAP is enabled, this field is not available.
PAP authentication	Performs EAP termination and uses PAP to communicate with the RADIUS server. If CHAP or EAP is enabled, this field is not available.
Max-tx period	Username request timeout timer in seconds.
Handshake period	Handshake timer in seconds.
Quiet timer	Status of the quiet timer, enabled or disabled.
Quiet period	Quiet timer in seconds.
Supp timeout	Client timeout timer in seconds.
Server timeout	Server timeout timer in seconds.
Reauth period	Periodic reauthentication timer in seconds.
Max auth requests	Maximum number of attempts for sending an authentication request to a client.
EAD assistant function	Whether EAD assistant is enabled.
URL	Redirect URL for unauthenticated users using a Web browser to access the network.
Free IP	Network segment accessible to unauthenticated users.
EAD timeout	EAD rule timer in minutes.
Domain delimiter	Domain delimiters supported by the device.
Max 802.1X users	Maximum number of concurrent 802.1X users each device supports.
Online 802.1X users	Number of online 802.1X users.
FortyGigE1/1/1 is link-up	Status of the port. In this example, FortyGigE 1/1/1 is up.
802.1X authentication	Whether 802.1X is enabled on the port.
Handshake	Whether the online user handshake feature is enabled on the port.
Handshake reply	Whether the online user handshake reply feature is enabled on the port.
Handshake security	Whether the online user handshake security feature is enabled on the port.
Unicast trigger	Whether the 802.1X unicast trigger is enabled on the port.
Periodic reauth	Whether periodic online user reauthentication is enabled on the port.
Port role	Role of the port. The port acts only as an Authenticator.
Authorization mode	Authorization state of the port, which can be Force-Authorized, Auto, or Force-Unauthorized.
Port access control	Access control method of the port: ·     MAC-based—MAC-based access control. ·     Port-based—Port-base access control.
Multicast trigger	Whether the 802.1X multicast trigger feature is enabled.
Mandatory auth domain	Mandatory authentication domain on the port.
Guest VLAN	802.1X guest VLAN configured on the port. If no 802.1X guest VLAN is configured on the port, this field displays Not configured.
Auth-Fail VLAN	802.1X Auth-Fail VLAN configured on the port. If no 802.1X Auth-Fail VLAN is configured on the port, this field displays Not configured.
Critical VLAN	802.1X critical VLAN configured on the port. If no 802.1X critical VLAN is configured on the port, this field displays Not configured.
Re-auth server-unreachable	Whether to log off online 802.1X users or keep them online when no server is reachable for 802.1X reauthentication.
Max online users	Maximum number of concurrent 802.1X users on the port.
EAPOL packets	Number of sent (Tx) and received (Rx) EAPOL packets.
Sent EAP Request/Identity packets	Number of sent EAP-Request/Identity packets.
EAP Request/Challenge packets	Number of sent EAP-Request/Challenge packets.
EAP Success packets	Number of sent EAP-Success packets.
EAP Failure packets	Number of sent EAP-Failure packets.
Received EAPOL Start packets	Number of received EAPOL-Start packets.
EAPOL LogOff packets	Number of received EAPOL-LogOff packets.
EAP Response/Identity packets	Number of received EAP-Response/Identity packets.
EAP Response/Challenge packets	Number of received EAP-Response/Challenge packets.
Error packets	Number of received error packets.
Online 802.1X users	Number of online 802.1X users on the port.
MAC address	MAC addresses of the online 802.1X users.
Auth state	Authentication status of the online 802.1X users.

 

display dot1x connection

Use display dot1x connection to display information about online 802.1X users.

Syntax

display dot1x connection [ interface interface-type interface-number | slot slot-number | user-mac mac-addr | user-name name-string ]

Views

Any view

Predefined user roles

network-admin

network-operator

Parameters

interface interface-type interface-number: Specifies a port by its type and number. If you do not specify a port, this command displays online 802.1X user information on all ports.

slot slot-number: Specifies an IRF member device by its member ID. If you do not specify a member device, this command displays online 802.1X user information on all member devices.

user-name name-string: Specifies an 802.1X user by its name. The name-string argument represents the username, a case-sensitive string of 1 to 253 characters.

user-mac mac-addr: Specifies an 802.1X user by its MAC address. The mac-addr argument represents the MAC address, in the form of H-H-H.

Examples

# Display information about all online 802.1X users.

<Sysname> display dot1x connection

Slot ID: 1

User MAC address: 0015-e9a6-7cfe

Access interface: FortyGigE1/1/1

Username: ias

Authentication domain: h3c

Authentication method: CHAP

Initial VLAN: 1

Authorization untagged VLAN: N/A

Authorization tagged VLAN list: 1 to 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 29 31 33

                                35 37 40 to 100

Authorization ACL ID: 3001

Authorization user profile: N/A

Termination action: Default

Session timeout period: 2 s

Online from: 2013/03/02  13:14:15

Online duration: 0h 2m 15s

 

Total 1 connections matched.

Table 2 Command output

Field	Description
Slot ID	Member ID of a device.
User MAC address	MAC address of the user.
Access interface	Interface through which the user access the device.
Authentication domain	ISP domain used for 802.1X authentication.
Authentication method	EAP message handling method: ·     CHAP—Performs EAP termination and uses CHAP to communicate with the RADIUS server. ·     EAP—Relays EAP packets and supports any of the EAP authentication methods to communicate with the RADIUS server. ·     PAP—Performs EAP termination and uses PAP to communicate with the RADIUS server.
Initial VLAN	VLAN to which the user belongs before 802.1X authentication.
Authorization untagged VLAN	Untagged VLAN authorized to the user.
Authorization tagged VLAN list	Tagged VLANs authorized to the user.
Authorization ACL ID	ACL authorized to the user.
Authorization user profile	User profile authorized to the user. The device does not support this field in the current software version.
Termination action	Action attribute assigned by the server when the session timeout timer expires: ·     Default—Logs off the online authenticated 802.1X user. This attribute does not take effect when periodic online user reauthentication is enabled and the periodic reauthentication timer is shorter than the session timeout timer. ·     Radius-request—Reauthenticates the online user when the session timeout timer expires, regardless of whether the periodic online reauthentication feature is enabled or not. If the device performs local authentication, this field displays N/A.
Session timeout period	Session timeout timer assigned by the server. If the device performs local authentication, this field displays N/A.
Online from	Time from which the 802.1X user came online.
Online duration	Online duration of the 802.1X user.
Total xxx connections matched.	Number of online 802.1X users.

 

dot1x

Use dot1x to enable 802.1X globally or on a port.

Use undo dot1x to disable 802.1X globally or on a port.

Syntax

dot1x

undo dot1x

Default

802.1X is neither enabled globally nor enabled for any port.

Views

System view, Layer 2 Ethernet interface view

Predefined user roles

network-admin

Usage guidelines

For 802.1X to take effect on a port, you must enable it both globally and on the port.

Examples

# Enable 802.1X globally.

<Sysname> system-view

[Sysname] dot1x

# Enable 802.1X on FortyGigE 1/1/1.

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x

[Sysname-FortyGigE1/1/1] quit

Related commands

display dot1x

dot1x authentication-method

Use dot1x authentication-method to specify an EAP message handling method.

Use undo dot1x authentication-method to restore the default.

Syntax

dot1x authentication-method { chap | eap | pap }

undo dot1x authentication-method

Default

The access device performs EAP termination and uses CHAP to communicate with the RADIUS server.

Views

System view

Predefined user roles

network-admin

Parameters

chap: Sets the access device to perform Extensible Authentication Protocol (EAP) termination and use the Challenge Handshake Authentication Protocol (CHAP) to communicate with the RADIUS server.

eap: Sets the access device to relay EAP packets, and supports any of the EAP authentication methods to communicate with the RADIUS server.

pap: Sets the access device to perform EAP termination and use the Password Authentication Protocol (PAP) to communicate with the RADIUS server.

Usage guidelines

The access device terminates or relays EAP packets.

·     In EAP termination mode—The access device re-encapsulates and sends the authentication data from the client in standard RADIUS packets to the RADIUS server. The device performs either CHAP or PAP authentication with the RADIUS server. In this mode the RADIUS server supports only MD5-Challenge EAP authentication, and the username and password EAP authentication initiated by an iNode client.

¡     PAP transports usernames and passwords in plain text. The authentication method applies to scenarios that do not require high security. To use PAP, the client can be an H3C iNode 802.1X client.

¡     CHAP transports username in plaintext and encrypted password over the network. CHAP is more secure than PAP.

·     In EAP relay mode—The access device relays EAP messages between the client and the RADIUS server. The EAP relay mode supports multiple EAP authentication methods, such as MD5-Challenge, EAP-TL, and PEAP. To use this mode, make sure the RADIUS server meets the following requirements:

¡     Supports the EAP-Message and Message-Authenticator attributes.

¡     Uses the same EAP authentication method as the client.

If this mode is used, the user-name-format command configured in RADIUS scheme view does not take effect. For more information about the user-name-format command, see "RADIUS commands."

If RADIUS authentication is used, you must configure the access device to use the same authentication method (PAP, CHAP, or EAP) as the RADIUS server.

Examples

# Enable the access device to terminate EAP packets and perform PAP authentication with the RADIUS server.

<Sysname> system-view

[Sysname] dot1x authentication-method pap

Related commands

display dot1x

dot1x auth-fail vlan

Use dot1x auth-fail vlan to configure an 802.1X Auth-Fail VLAN on a port.

Use undo dot1x auth-fail vlan to restore the default.

Syntax

dot1x auth-fail vlan authfail-vlan-id

undo dot1x auth-fail vlan

Default

No 802.1X Auth-Fail VLAN is configured on a port.

Views

Ethernet interface view

Predefined user roles

network-admin

Parameters

authfail-vlan-id: Specifies the ID of the 802.1X Auth-Fail VLAN on the port. The value range for the VLAN ID is 1 to 4094. Make sure the VLAN has been created and is not a super VLAN. For more information about super VLANs, see Layer 2—LAN Switching Configuration Guide.

Usage guidelines

An 802.1X Auth-Fail VLAN accommodates users who have failed 802.1X authentication for any other reason than unreachable servers.

To delete a VLAN that has been configured as an 802.1X Auth-Fail VLAN, you must first use the undo dot1x auth-fail vlan command.

Examples

# Configure VLAN 100 as the Auth-Fail VLAN on port FortyGigE 1/1/1.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x auth-fail vlan 100

Related commands

display dot1x

dot1x critical vlan

Use dot1x critical vlan to configure an 802.1X critical VLAN on a port.

Use undo dot1x critical vlan to restore the default.

Syntax

dot1x critical vlan vlan-id

undo dot1x critical vlan

Default

No 802.1X critical VLAN is configured on any port.

Views

Ethernet interface view

Predefined user roles

network-admin

Parameters

vlan-id: Specifies the ID of the 802.1X critical VLAN on the port. The value range for the VLAN ID is 1 to 4094. Make sure the VLAN has been created and is not a super VLAN. For more information about super VLANs, see Layer 2—LAN Switching Configuration Guide.

Usage guidelines

An 802.1X critical VLAN accommodates users who fail 802.1X authentication because all the RADIUS servers in their ISP domains are unreachable.

To delete a VLAN that has been configured as an 802.1X critical VLAN, you must first use the undo dot1x critical vlan command.

Examples

# Specify VLAN 100 as the 802.1X critical VLAN on port FortyGigE 1/1/1.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x critical vlan 100

Related commands

display dot1x

dot1x domain-delimiter

Use dot1x domain-delimiter to specify a set of domain name delimiters supported by the device.

Use undo dot1x domain-delimiter to restore the default.

Syntax

dot1x domain-delimiter string

undo dot1x domain-delimiter

Default

The device supports only the at sign (@) delimiter for 802.1X users.

Views

System view

Predefined user roles

network-admin

Parameters

string: Specifies a set of 1 to 16 domain name delimiters for 802.1X users. No space is required between delimiters. Available delimiters include the at sign (@),backslash (\), dot (.), and forward slash (/). If you want to use backslash (\) as the domain name delimiter, you must enter the escape character (\) along with the backslash (\) sign.

Usage guidelines

Any character in the configured set can be used as the domain name delimiter for 802.1X authentication users. Usernames that include domain names can use the format of username@domain-name, domain-name\username, username.domain-name, or username/domain-name.

The delimiter set you configured overrides the default setting. If the at sign (@) is not included in the delimiter set, the device does not support the 802.1X users who use this sign as the domain name delimiter.

If a username string contains multiple configured delimiters, the device takes the rightmost delimiter in the username string as the domain name delimiter. For example, if you configure the forward slash (/), dot (.), and backslash (\) as delimiters, the domain name delimiter for the username string 121.123/22\@abc is the backslash (\). The username is @abc and the domain name is 121.123/22.

Examples

# Specify the at sign (@) and forward slash (/) as domain name delimiters.

<Sysname> system-view

[Sysname] dot1x domain-delimiter @/

Related commands

display dot1x

dot1x ead-assistant enable

Use dot1x ead-assistant enable to enable the EAD assistant feature.

Use undo dot1x ead-assistant enable to disable the EAD assistant feature.

Syntax

dot1x ead-assistant enable

undo dot1x ead-assistant enable

Default

The EAD assistant feature is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

The EAD assistant feature enables the access device to redirect a user seeking to access the network to download and install EAD client. This feature eliminates the tedious job of the administrator to deploy EAD clients.

The feature is mutually exclusive with MAC authentication and port security. You must disable MAC authentication and port security globally before you enable the EAD assistant feature.

To make the EAD assistant feature take effect on a port, you must enable 802.1X on the port and set the port authorization mode to auto.

Examples

# Enable the EAD assistant feature.

<Sysname> system-view

[Sysname] dot1x ead-assistant enable

Related commands

·     display dot1x

·     dot1x ead-assistant free-ip

·     dot1x ead-assistant url

dot1x ead-assistant free-ip

Use dot1x ead-assistant free-ip to configure a free IP.

Use undo dot1x ead-assistant free-ip to restore the default.

Syntax

dot1x ead-assistant free-ip ip-address { mask-address | mask-length }

undo dot1x ead-assistant free-ip { ip-address { mask-address | mask-length } | all }

Default

No free IP is configured. Users cannot access any segments before they pass 802.1X authentication.

Views

System view

Predefined user roles

network-admin

Parameters

ip-address: Specifies a freely accessible IP address segment, also called a free IP.

mask: Specifies an IP address mask.

mask-length: Specifies IP address mask length in the range of 1 to 32.

all: Removes all free IP addresses.

Usage guidelines

Execute this command multiple times to configure multiple free IPs.

With EAD assistant enabled on the device, unauthenticated 802.1X users can access the network resources in the free IP segments before they pass 802.1X authentication.

Examples

# Configure 192.168.1.1/16 as a free IP.

<Sysname> system-view

[Sysname] dot1x ead-assistant free-ip 192.168.1.1 255.255.0.0

Related commands

·     display dot1x

·     dot1x ead-assistant enable

·     dot1x ead-assistant url

dot1x ead-assistant url

Use dot1x ead-assistant url to configure a redirect URL.

Use undo dot1x ead-assistant url to restore the default.

Syntax

dot1x ead-assistant url url-string

undo dot1x ead-assistant url

Default

No redirect URL is configured.

Views

System view

Predefined user roles

network-admin

Parameters

url-string: Specifies a redirect URL, a case-insensitive string of 1 to 64 characters in the format http://string.

Usage guidelines

When an unauthenticated user uses a Web browser to access networks other than the free IP, the device redirects the user to the redirect URL.

The redirect URL must be on the free IP subnet.

If you execute the dot1x ead-assistant url command multiple times, the most recent configuration takes effect.

Examples

# Configure the redirect URL as http://test.com.

<Sysname> system-view

[Sysname] dot1x ead-assistant url http://test.com

Related commands

·     display dot1x

·     dot1x ead-assistant enable

·     dot1x ead-assistant free-ip

dot1x guest-vlan

Use dot1x guest-vlan to configure an 802.1X guest VLAN on a port.

Use undo dot1x guest-vlan to restore the default.

Syntax

dot1x guest-vlan guest-vlan-id

undo dot1x guest-vlan

Default

No 802.1X guest VLAN is configured on a port.

Views

Ethernet interface view

Predefined user roles

network-admin

Parameters

guest-vlan-id: Specifies the ID of the 802.1X guest VLAN. The value range for the VLAN ID is 1 to 4094. Make sure the VLAN has been created and is not a super VLAN. For more information about super VLANs, see Layer 2—LAN Switching Configuration Guide.

Usage guidelines

An 802.1X guest VLAN accommodates users who have not performed 802.1X authentication. In the guest VLAN, users can access a limited set of network resources, such as a software server, to download anti-virus software and system patches.

To delete a VLAN that has been configured as a guest VLAN, you must use the undo dot1x guest-vlan command first.

Examples

# Specify VLAN 100 as the 802.1X guest VLAN on port FortyGigE 1/1/1.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x guest-vlan 100

Related commands

display dot1x

dot1x handshake

Use dot1x handshake to enable the online user handshake feature.

Use undo dot1x handshake to disable the feature.

Syntax

dot1x handshake

undo dot1x handshake

Default

The online user handshake feature is enabled.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Usage guidelines

The online user handshake feature enables the device to periodically send handshake messages to the client for verifying the connectivity status of online 802.1X users. If the device does not receive any responses from an online user after making the maximum handshake attempts within the handshake timer, it sets the user to offline state. To set the handshake timer, use the dot1x timer handshake-period command. To set the maximum handshake attempts, use the dot1x retry command.

Examples

# Enable the online user handshake feature on FortyGigE 1/1/1.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x handshake

Related commands

·     display dot1x

·     dot1x handshake reply enable

·     dot1x timer handshake-period

·     dot1x retry

dot1x handshake reply enable

Use dot1x handshake reply enable to enable the 802.1X online user handshake reply feature.

Use undo dot1x handshake reply enable to restore the default.

Syntax

dot1x handshake reply enable

undo dot1x handshake reply enable

Default

The device does not reply to 802.1X clients' Identity EAP-Response packets during the online handshake process.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Usage guidelines

This command enables the device to reply to 802.1X clients' Identity EAP-Response packets with EAP-Success packets during the online handshake process.

H3C recommends that you use this command only if 802.1X clients will go offline without receiving EAP-Success packets from the device.

Examples

# Enable the 802.1X online user handshake reply feature on FortyGigE 1/1/1.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x handshake reply enable

Related commands

dot1x handshake

dot1x handshake secure

Use dot1x handshake secure to enable the online user handshake security feature.

Use undo dot1x handshake secure to restore the default.

Syntax

dot1x handshake secure

undo dot1x handshake secure

Default

The online user handshake security feature is disabled.

Views

Ethernet interface view

Predefined user roles

network-admin

Usage guidelines

The online user handshake security feature enables the device to prevent users from using illegal client software.

The device implements the feature based on the online user handshake feature. To bring the security feature into effect, make sure the online user handshake feature is enabled.

The online user handshake security feature takes effect only on the network where the iNode client and IMC server are used.

Examples

# Enable the online user handshake security feature on port FortyGigE 1/1/1.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x handshake secure

Related commands

·     display dot1x

·     dot1x handshake

dot1x mandatory-domain

Use dot1x mandatory-domain to specify a mandatory 802.1X authentication domain on a port.

Use undo dot1x mandatory-domain to remove the mandatory authentication domain.

Syntax

dot1x mandatory-domain domain-name

undo dot1x mandatory-domain

Default

No mandatory authentication domain is specified.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Parameters

domain-name: Specifies the ISP domain name, a case-insensitive string of 1 to 24 characters.

Usage guidelines

When the system authenticates an 802.1X user trying to access a port, it selects an authentication domain in the following order:

1.     Mandatory domain.

2.     ISP domain specified in the username.

3.     Default ISP domain.

Examples

# Configure the mandatory authentication domain my-domain for 802.1X users on FortyGigE 1/1/1.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x mandatory-domain my-domain

Related commands

display dot1x

dot1x max-user

Use dot1x max-user to set the maximum number of concurrent 802.1X users on a port.

Use undo dot1x max-user to restore the default.

Syntax

dot1x max-user user-number

undo dot1x max-user

Default

The maximum number of concurrent 802.1X users on a port is 4294967295.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Parameters

user-number: Sets the maximum number of concurrent 802.1X users on a port. The value range is 1 to 4294967295.

Usage guidelines

Set the maximum number of concurrent 802.1X users on a port to prevent the system resources from being overused. When the maximum number is reached, the port denies subsequent 802.1X users.

Examples

# Set the maximum number of concurrent 802.1X users on FortyGigE 1/1/1 to 32.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x max-user 32

Related commands

display dot1x

dot1x multicast-trigger

Use dot1x multicast-trigger to enable the 802.1X multicast trigger feature.

Use undo dot1x multicast-trigger to disable the feature.

Syntax

dot1x multicast-trigger

undo dot1x multicast-trigger

Default

The multicast trigger feature is enabled.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Usage guidelines

The multicast trigger feature enables the device to act as the initiator. The device periodically multicasts Identify EAP-Request packets out of a port to detect 802.1X clients and trigger authentication. You can use the dot1x timer tx-period command to set the interval for sending multicast Identify EAP-Request packets.

Examples

# Enable the multicast trigger feature on FortyGigE 1/1/1.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x multicast-trigger

Related commands

·     display dot1x

·     dot1x timer tx-period

·     dot1x unicast-trigger

dot1x port-control

Use dot1x port-control to set the authorization state for the port.

Use undo dot1x port-control to restore the default.

Syntax

dot1x port-control { authorized-force | auto | unauthorized-force }

undo dot1x port-control

Default

The default port authorization state is auto.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Parameters

authorized-force: Places the port in authorized state, enabling users on the port to access the network without authentication.

auto: Places the port initially in unauthorized state to allow only EAPOL packets to pass, and places the port in authorized state after a user passes authentication. You can use this option in most scenarios.

unauthorized-force: Places the port in unauthorized state, denying any access requests from users on the port.

Usage guidelines

You can use this command to set the port authorization state to determine whether a client is granted access to the network or not.

Examples

# Set the authorization state of port FortyGigE 1/1/1 to unauthorized-force.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x port-control unauthorized-force

Related commands

display dot1x

dot1x port-method

Use dot1x port-method to specify an access control method for the port.

Use undo dot1x port-method to restore the default.

Syntax

dot1x port-method { macbased | portbased }

undo dot1x port-method

Default

MAC-based access control applies.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Parameters

macbased: Uses MAC-based access control on the port to separately authenticate each user attempting to access the network. Using this method, when an authenticated user logs off, no other online users are affected.

portbased: Uses port-based access control on the port. Using this method, once an 802.1X user passes authentication on the port, any subsequent user can access the network through the port without authentication. When the authenticated user logs off, all other users are logged off.

Examples

# Configure FortyGigE 1/1/1 to implement port-based access control.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x port-method portbased

Related commands

display dot1x

dot1x quiet-period

Use dot1x quiet-period to enable the quiet timer.

Use undo dot1x quiet-period to disable the timer.

Syntax

dot1x quiet-period

undo dot1x quiet-period

Default

The quiet timer is disabled.

Views

System view

Predefined user roles

network-admin

Usage guidelines

When a client fails 802.1X authentication, the device must wait a period of time before it can process authentication requests from the client. You can use the dot1x timer quiet-period command to set the quieter timer.

Examples

# Enable the quiet timer, and set the quiet timer to 100 seconds.

<Sysname> system-view

[Sysname] dot1x quiet-period

[Sysname] dot1x timer quiet-period 100

Related commands

·     display dot1x

·     dot1x timer

dot1x re-authenticate

Use dot1x re-authenticate to enable the periodic online user reauthentication feature.

Use undo dot1x re-authenticate to disable the feature.

Syntax

dot1x re-authenticate

undo dot1x re-authenticate

Default

The periodic online user reauthentication feature is disabled.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Usage guidelines

Periodic reauthentication enables the access device to periodically authenticate online 802.1X users on a port. This feature tracks the connection status of online users and updates the authorization attributes assigned by the server.

You can use the dot1x timer reauth-period command to configure the interval for reauthentication.

Examples

# Enable the 802.1X periodic online user reauthentication feature on FortyGigE 1/1/1 and set the periodic reauthentication interval to 1800 seconds.

<Sysname> system-view

[Sysname] dot1x timer reauth-period 1800

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x re-authenticate

Related commands

·     display dot1x

·     dot1x timer

dot1x re-authenticate server-unreachable keep-online

Use dot1x re-authenticate server-unreachable keep-online to enable the keep-online feature on a port. This feature keeps authenticated 802.1X users online when no server is reachable for 802.1X reauthentication.

Use undo dot1x re-authenticate server-unreachable to restore the default.

Syntax

dot1x re-authenticate server-unreachable keep-online

undo dot1x re-authenticate server-unreachable

Default

The keep-online feature is disabled. The device logs off online 802.1X authenticated users if no server is reachable for 802.1X reauthentication.

Views

Ethernet interface view

Predefined user roles

network-admin

Examples

# Enable the keep-online feature on FortyGigE 1/1/1 for 802.1X reauthentication.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x re-authenticate server-unreachable keep-online

Related commands

·     display dot1x

·     dot1x re-authenticate

dot1x retry

Use dot1x retry to set the maximum number of attempts for sending an authentication request to a client.

Use undo dot1x retry to restore the default.

Syntax

dot1x retry max-retry-value

undo dot1x retry

Default

The maximum number of attempts is 2.

Views

System view

Predefined user roles

network-admin

Parameters

max-retry-value: Sets the maximum number of attempts for sending an authentication request to a client. The value range is 1 to 10.

Usage guidelines

The access device retransmits an authentication request to a client in any of the following situations:

·     The device does not receive any responses from the client within the username request timeout timer. The timer is set by using the dot1x timer tx-period tx-period-value command for the EAP-Request/Identity packet.

·     The device does not receive any responses from the client within the client timeout timer. The timer is set by using the dot1x timer supp-timeout supp-timeout-value command for the EAP-Request MD5 Challenge packet.

The access device stops retransmitting the request, if it has made the maximum number of request transmission attempts but still received no response.

Examples

# Set the maximum number of attempts to 9 for sending an authentication request to a client.

<Sysname> system-view

[Sysname] dot1x retry 9

Related commands

·     display dot1x

·     dot1x timer

dot1x timer

Use dot1x timer to set 802.1X timers.

Use undo dot1x timer to restore the defaults.

Syntax

dot1x timer { ead-timeout ead-timeout-value | handshake-period handshake-period-value | quiet-period quiet-period-value | reauth-period reauth-period-value | server-timeout server-timeout-value | supp-timeout supp-timeout-value | tx-period tx-period-value }

undo dot1x timer { ead-timeout | handshake-period | quiet-period | reauth-period | server-timeout | supp-timeout | tx-period }

Default

The following timers apply:

·     EAD rule timer: 30 minutes.

·     Handshake timer: 15 seconds.

·     Quiet timer: 60 seconds.

·     Periodic reauthentication timer: 3600 seconds.

·     Server timeout timer: 100 seconds.

·     Client timeout timer: 30 seconds.

·     Username request timeout timer: 30 seconds.

Views

System view

Predefined user roles

network-admin

Parameters

ead-timeout ead-timeout-value: Sets the EAD rule timer in minutes. The value range for the ead-timeout-value argument is 1 to 1440.

handshake-period handshake-period-value: Sets the handshake timer in seconds. The value range for the handshake-period-value argument is 5 to 1024.

quiet-period quiet-period-value: Sets the quiet timer in seconds. The value range for the quiet-period-value argument is 10 to 120.

reauth-period reauth-period-value: Sets the periodic reauthentication timer in seconds. The value range for the reauth-period-value argument is 60 to 7200.

server-timeout server-timeout-value: Sets the server timeout timer in seconds. The value range for the server-timeout-value argument is 100 to 300.

supp-timeout supp-timeout-value: Sets the client timeout timer in seconds. The value range for the supp-timeout-value argument is 1 to 120.

tx-period tx-period-value: Sets the username request timeout timer in seconds. The value range for the tx-period-value argument is 10 to 120.

Usage guidelines

In most cases, the default settings are sufficient. You can edit the timers, depending on the network conditions.

·     In a low-speed network, increase the client timeout timer.

·     In a vulnerable network, set the quiet timer to a high value.

·     In a high-performance network with quick authentication response, set the quiet timer to a low value.

·     In a network with authentication servers of different performance, adjust the server timeout timer.

The network device uses the following 802.1X timers:

·     EAD rule timer (EAD timeout)—Sets the lifetime of each EAD rule. When the timer expires or the user passes authentication, the rule is removed. If users fail to download the EAD client or fail to pass authentication within the timer, they must reconnect to the network to access the free IP.

·     Handshake timer (handshake-period)—Sets the interval at which the access device sends client handshake requests to check the online status of a client that has passed authentication. If the device receives no response after sending the maximum number of handshake requests, it considers that the client has logged off.

·     Quiet timer (quiet-period)—Starts when a client fails authentication. The access device must wait the time period before it can process the authentication attempts from the client.

·     Periodic reauthentication timer (reauth-period)—Sets the interval at which the network device periodically reauthenticates online 802.1X users. To enable periodic online user reauthentication on a port, use the dot1x re-authenticate command. The change to the periodic reauthentication timer applies to the users that have been online only after the old timer expires.

·     Server timeout timer (server-timeout)—Starts when the access device sends a RADIUS Access-Request packet to the authentication server. If no response is received when this timer expires, the access device retransmits the request to the server.

·     Client timeout timer (supp-timeout)—Starts when the access device sends an EAP-Request/MD5 Challenge packet to a client. If no response is received when this timer expires, the access device retransmits the request to the client.

·     Username request timeout timer (tx-period)—Starts when the device sends an EAP-Request/Identity packet to a client in response to an authentication request. If the device receives no response before this timer expires, it retransmits the request. The timer also sets the interval at which the network device sends multicast EAP-Request/Identity packets to detect clients that cannot actively request authentication.

Examples

# Set the server timeout timer to 150 seconds.

<Sysname> system-view

[Sysname] dot1x timer server-timeout 150

Related commands

display dot1x

dot1x unicast-trigger

Use dot1x unicast-trigger to enable the 802.1X unicast trigger feature.

Use undo dot1x unicast-trigger to disable the feature.

Syntax

dot1x unicast-trigger

undo dot1x unicast-trigger

Default

The unicast trigger feature is disabled.

Views

Layer 2 Ethernet interface view

Predefined user roles

network-admin

Usage guidelines

The unicast trigger feature enables the access device to initiate 802.1X authentication when the device receives a data frame from an unknown source MAC address. The device sends a unicast Identity EAP/Request packet to the unknown source MAC address. It will retransmit the packet if it does not receive any responses within a period of time (set by using the dot1x timer tx-period command). This process continues until the maximum number of request attempts (set by using the dot1x retry command) is reached.

Examples

# Enable the unicast trigger feature on FortyGigE 1/1/1.

<Sysname> system-view

[Sysname] interface fortygige 1/1/1

[Sysname-FortyGigE1/1/1] dot1x unicast-trigger

Related commands

·     display dot1x

·     dot1x multicast-trigger

·     dot1x retry

·     dot1x timer

reset dot1x guest-vlan

Use reset dot1x guest-vlan to remove users from the 802.1X guest VLAN on a port.

Syntax

reset dot1x guest-vlan interface interface-type interface-number [ mac-address mac-address ]

Views

User view

Predefined user roles

network-admin

Parameters

interface interface-type interface-number: Specifies a port by its type and number.

mac-address mac-address: Specifies the MAC address of an 802.1X user in the guest VLAN.

Examples

# Remove the 802.1X user with MAC address 1-1-1 from the 802.1X guest VLAN on port FortyGigE 1/1/1.

<Sysname> reset dot1x guest-vlan interface fortygige 1/1/1 mac-address 1-1-1

Related commands

dot1x guest-vlan

reset dot1x statistics

Use reset dot1x statistics to clear 802.1X statistics on ports.

Syntax

reset dot1x statistics [ interface interface-type interface-number ]

Views

User view

Predefined user roles

network-admin

Parameters

interface interface-type interface-number: Specifies a port by its type and number. If you do not specify a port, the command clears 802.1X statistics on all ports.

Examples

# Clear 802.1X statistics on FortyGigE 1/1/1.

<Sysname> reset dot1x statistics interface fortygige 1/1/1

Related commands

display dot1x