Login
- Table of Contents
-
- 12-Security Command Reference
- 00-Preface
- 01-MAC authentication commands
- 02-Password control commands
- 03-Keychain commands
- 04-Public key management commands
- 05-PKI commands
- 06-IPsec commands
- 07-SSH commands
- 08-SSL commands
- 09-Session management commands
- 10-Object group commands
- 11-Attack detection and prevention commands
- 12-TCP and ICMP attack prevention commands
- 13-IP source guard commands
- 14-ARP attack protection commands
- 15-ND attack defense commands
- 16-uRPF commands
- 17-Crypto engine commands
- 18-DAE proxy commands
- 19-802.1X commands
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 19-802.1X commands | 107.00 KB |
Contents
802.1X commands
display dot1x
Use display dot1x to display information about 802.1X.
Syntax
display dot1x [ sessions | statistics ] [ interface interface-type interface-number ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
sessions: Displays 802.1X session information.
statistics: Displays 802.1X statistics.
interface interface-type interface-number: Specifies a port by its type and number. If you do not specify a port, this command displays 802.1X information for all 802.1X-enabled ports.
Usage guidelines
If you do not specify the sessions keyword or the statistics keyword, this command displays all information about 802.1X, including session information, statistics, and settings.
Examples
# Display all information about 802.1X.
<Sysname> display dot1x
Global 802.1X parameters:
802.1X authentication : Enabled
CHAP authentication : Enabled
Max-tx period : 30 s
Handshake period : 15 s
Quiet timer : Disabled
Quiet period : 60 s
Supp timeout : 30 s
Server timeout : 100 s
Reauth period : 3600 s
Max auth requests : 2
EAD assistant function : Disabled
URL : http://www.dwsoft.com
Free IP : 6.6.6.0 255.255.255.0
EAD timeout : 30 min
Domain delimiter : @
Online 802.1X wired users : 1
GigabitEthernet3/1/1 is link-up
802.1X authentication : Enabled
Handshake : Enabled
Handshake reply : Disabled
Handshake security : Disabled
Unicast trigger : Disabled
Periodic reauth : Disabled
Port role : Authenticator
Authorization mode : Auto
Port access control : Port-based
Multicast trigger : Enabled
Mandatory auth domain : Not configured
Guest VLAN : 3
Auth-Fail VLAN : Not configured
Critical VLAN : Not configured
Critical voice VLAN : Disabled
Re-auth server-unreachable : Logoff
Max online users : 256
Max Attempts Fail Number : 0
Send Packets Without Tag : Disabled
EAPOL packets: Tx 3, Rx 3
Sent EAP Request/Identity packets : 1
EAP Request/Challenge packets: 1
EAP Success packets: 1
EAP Failure packets: 0
Received EAPOL Start packets : 1
EAPOL LogOff packets: 1
EAP Response/Identity packets : 1
EAP Response/Challenge packets: 1
Error packets: 0
Online 802.1X users: 1
MAC address Auth state
0001-0000-0000 Authenticated
|
Field |
Description |
|
Global 802.1X parameters |
Global 802.1X configuration. |
|
802.1X authentication |
Whether 802.1X is enabled globally. |
|
CHAP authentication |
Performs EAP termination and uses CHAP to communicate with the RADIUS server. |
|
EAP authentication |
Relays EAP packets and supports any of the EAP authentication methods to communicate with the RADIUS server. |
|
PAP authentication |
Performs EAP termination and uses PAP to communicate with the RADIUS server. |
|
Max-tx period |
Username request timeout timer in seconds. |
|
Handshake period |
Handshake timer in seconds. |
|
Quiet timer |
Status of the quiet timer, enabled or disabled. |
|
Quiet period |
Quiet timer in seconds. |
|
Supp timeout |
Client timeout timer in seconds. |
|
Server timeout |
Server timeout timer in seconds. |
|
Reauth period |
This field is not supported in the current software version. Periodic reauthentication timer in seconds. |
|
Max auth requests |
Maximum number of attempts for sending an authentication request to a client. |
|
EAD assistant function |
This field is not supported in the current software version. Whether EAD assistant is enabled. |
|
URL |
This field is not supported in the current software version. Redirect URL for unauthenticated users using a Web browser to access the network. |
|
Free IP |
This field is not supported in the current software version. Network segment accessible to unauthenticated users. |
|
EAD timeout |
This field is not supported in the current software version. EAD rule timer in minutes. |
|
Domain delimiter |
Domain delimiters supported by the device. |
|
Online 802.1X wired users |
Number of wired online 802.1X users, including users that have passed 802.1X authentication and users that are performing 802.1X authentication. |
|
GigabitEthernet3/1/1 is link-up |
Status of the port. In this example, GigabitEthernet 3/1/1 is up. |
|
802.1X authentication |
Whether 802.1X is enabled on the port. |
|
Handshake |
Whether the online user handshake feature is enabled on the port. |
|
Handshake reply |
Whether the online user handshake reply feature is enabled on the port. |
|
Handshake security |
Whether the online user handshake security feature is enabled on the port. |
|
Unicast trigger |
Whether the 802.1X unicast trigger is enabled on the port. |
|
Periodic reauth |
This field is not supported in the current software version. Whether periodic online user reauthentication is enabled on the port. |
|
Port role |
Role of the port. The port functions only as an Authenticator. |
|
Authorization mode |
Authorization state of the port, which can be Force-Authorized, Auto, or Force-Unauthorized. |
|
Port access control |
Access control method of the port, which is Port-based. |
|
Multicast trigger |
Whether the 802.1X multicast trigger feature is enabled. |
|
Mandatory auth domain |
Mandatory authentication domain on the port. |
|
Guest VLAN |
802.1X guest VLAN configured on the port. If no 802.1X guest VLAN is configured on the port, this field displays Not configured. |
|
Auth-Fail VLAN |
802.1X Auth-Fail VLAN configured on the port. If no 802.1X Auth-Fail VLAN is configured on the port, this field displays Not configured. |
|
Critical VLAN |
802.1X critical VLAN configured on the port. If no 802.1X critical VLAN is configured on the port, this field displays Not configured. |
|
Critical voice VLAN |
This field is not supported in the current software version. Whether the 802.1X critical voice VLAN feature is enabled on the port. |
|
Re-auth server-unreachable |
This field is not supported in the current software version. Whether to log off online 802.1X users or keep them online when no server is reachable for 802.1X reauthentication. |
|
Max online users |
Maximum number of concurrent 802.1X users on the port. |
|
Max Attempts Fail Number |
This field is not supported in the current software version. Maximum number of 802.1X authentication attempts for MAC authenticated users. |
|
Send Packets Without Tag |
This field is not supported in the current software version. Whether to remove the VLAN tags of all 802.1X protocol packets sent out of the port to 802.1X clients. |
|
EAPOL packets |
Number of sent (Tx) and received (Rx) EAPOL packets. |
|
Sent EAP Request/Identity packets |
Number of sent EAP-Request/Identity packets. |
|
EAP Request/Challenge packets |
Number of sent EAP-Request/MD5-Challenge packets. |
|
EAP Success packets |
Number of sent EAP-Success packets. |
|
EAP Failure packets |
Number of sent EAP-Failure packets. |
|
Received EAPOL Start packets |
Number of received EAPOL-Start packets. |
|
EAPOL LogOff packets |
Number of received EAPOL-LogOff packets. |
|
EAP Response/Identity packets |
Number of received EAP-Response/Identity packets. |
|
EAP Response/Challenge packets |
Number of received EAP-Response/MD5-Challenge packets. |
|
Error packets |
Number of received error packets. |
|
Online 802.1X users |
Number of online 802.1X users on the port, including users that have passed 802.1X authentication and users that are performing 802.1X authentication. |
|
MAC address |
MAC addresses of the online 802.1X users. |
|
Auth state |
Authentication status of the online 802.1X users. |
display dot1x connection
Use display dot1x connection to display information about online 802.1X users.
Syntax
In standalone mode:
display dot1x connection [ interface interface-type interface-number | slot slot-number | user-mac mac-address | user-name name-string ]
In IRF mode:
display dot1x connection [ chassis chassis-number slot slot-number | interface interface-type interface-number | user-mac mac-address | user-name name-string ]
Views
Any view
Predefined user roles
network-admin
network-operator
Parameters
interface interface-type interface-number: Specifies a port by its type and number. If you do not specify a port, this command displays online 802.1X user information for all ports.
slot slot-number: Specifies a card by its slot number. If you do not specify a card, this command displays online 802.1X user information for all cards. (In standalone mode.)
chassis chassis-number slot slot-number: Specifies a card on an IRF member device. The chassis-number argument represents the member ID of the IRF member device. The slot-number argument represents the slot number of the card. If you do not specify a card, this command displays online 802.1X user information for all cards on all IRF member devices. (In IRF mode.)
user-mac mac-address: Specifies an 802.1X user by MAC address. The mac-address argument represents the MAC address of the user, in the form of H-H-H. If you do not specify an 802.1X user, this command displays all online 802.1X user information.
user-name name-string: Specifies an 802.1X user by its name. The name-string argument represents the username, a case-sensitive string of 1 to 253 characters. If you do not specify an 802.1X user, this command displays all online 802.1X user information.
Examples
# (In standalone mode.) Display information about all online 802.1X users.
<Sysname> display dot1x connection
Slot ID: 1
User MAC address: 0015-e9a6-7cfe
Access interface: GigabitEthernet3/1/1
Username: ias
Authentication domain: h3c
IPv4 address: 192.168.1.1
IPv6 address: 2000:0:0:0:1:2345:6789:abcd
Authentication method: CHAP
Initial VLAN: 1
Authorization untagged VLAN: 6
Authorization tagged VLAN list: 1 to 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 29 31 33
35 37 40 to 100
Authorization ACL ID: 3001
Authorization user profile: N/A
Termination action: Default
Session timeout period: 2 s
Online from: 2013/03/02 13:14:15
Online duration: 0h 2m 15s
Total 1 connections matched.
Table 2 Command output
|
Field |
Description |
|
User MAC address |
MAC address of the user. |
|
Access interface |
Interface through which the user access the device. |
|
Authentication domain |
ISP domain used for 802.1X authentication. |
|
IPv4 address |
IPv4 address of the user. If the device does not get the IPv4 address of the user, this field is not available. |
|
IPv6 address |
IPv6 address of the user. If the device does not get the IPv6 address of the user, this field is not available. |
|
Authentication method |
EAP message handling method: · CHAP—Performs EAP termination and uses CHAP to communicate with the RADIUS server. · EAP—Relays EAP packets and supports any of the EAP authentication methods to communicate with the RADIUS server. · PAP—Performs EAP termination and uses PAP to communicate with the RADIUS server. |
|
Initial VLAN |
VLAN to which the user belongs before 802.1X authentication. |
|
Authorization untagged VLAN |
Untagged VLAN authorized to the user. |
|
Authorization tagged VLAN list |
Tagged VLANs authorized to the user. |
|
Authorization ACL ID |
This field is not supported in the current software version. ACL authorized to the user. |
|
Authorization user profile |
User profile authorized to the user. |
|
Termination action |
Action attribute assigned by the server to terminate the user session. If the value for this field is Default, the device logs off the online authenticated 802.1X user when the session timeout timer expires. If the device performs local authentication, this field displays N/A. |
|
Session timeout period |
Session timeout timer assigned by the server. If the device performs local authentication, this field displays N/A. |
|
Online from |
Time from which the 802.1X user came online. |
|
Online duration |
Online duration of the 802.1X user. |
|
Total xxx connections matched. |
Number of online 802.1X users. |
dot1x
Use dot1x to enable 802.1X globally or on a port.
Use undo dot1x to disable 802.1X globally or on a port.
Syntax
dot1x
undo dot1x
Default
802.1X is neither enabled globally nor enabled for any port.
Views
System view
Ethernet interface view
Predefined user roles
network-admin
Usage guidelines
For the 802.1X feature to take effect on a port, you must enable the feature both globally and on the port.
Examples
# Enable 802.1X globally.
<Sysname> system-view
[Sysname] dot1x
# Enable 802.1X on GigabitEthernet 3/1/1.
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x
[Sysname-GigabitEthernet3/1/1] quit
Related commands
display dot1x
dot1x authentication-method
Use dot1x authentication-method to specify an EAP message handling method.
Use undo dot1x authentication-method to restore the default.
Syntax
dot1x authentication-method { chap | eap | pap }
undo dot1x authentication-method
Default
The access device performs EAP termination and uses CHAP to communicate with the RADIUS server.
Views
System view
Predefined user roles
network-admin
Parameters
chap: Configures the access device to perform Extensible Authentication Protocol (EAP) termination and use the Challenge Handshake Authentication Protocol (CHAP) to communicate with the RADIUS server.
eap: Configures the access device to relay EAP packets, and supports any of the EAP authentication methods to communicate with the RADIUS server.
pap: Configures the access device to perform EAP termination and use the Password Authentication Protocol (PAP) to communicate with the RADIUS server.
Usage guidelines
The access device terminates or relays EAP packets.
· In EAP termination mode—The access device re-encapsulates and sends the authentication data from the client in standard RADIUS packets to the RADIUS server. The device performs either CHAP or PAP authentication with the RADIUS server. In this mode the RADIUS server supports only MD5-Challenge EAP authentication, and the username and password EAP authentication initiated by an iNode client.
? PAP transports usernames and passwords in plain text. The authentication method applies to scenarios that do not require high security. To use PAP, the client can be an iNode 802.1X client.
? CHAP transports usernames in plain text and passwords in encrypted form over the network. CHAP is more secure than PAP.
· In EAP relay mode—The access device relays EAP messages between the client and the RADIUS server. The EAP relay mode supports multiple EAP authentication methods, such as MD5-Challenge, EAP-TLS, and PEAP. To use this mode, make sure the RADIUS server meets the following requirements:
? Supports the EAP-Message and Message-Authenticator attributes.
? Uses the same EAP authentication method as the client.
If this mode is used, the user-name-format command configured in RADIUS scheme view does not take effect. For more information about the user-name-format command, see AAA commands in BRAS Services Command Reference.
If RADIUS authentication is used, you must configure the access device to use the same authentication method (PAP, CHAP, or EAP) as the RADIUS server.
Examples
# Enable the access device to terminate EAP packets and perform PAP authentication with the RADIUS server.
<Sysname> system-view
[Sysname] dot1x authentication-method pap
Related commands
display dot1x
dot1x auth-fail vlan
Use dot1x auth-fail vlan to configure an 802.1X Auth-Fail VLAN on a port.
Use undo dot1x auth-fail vlan to restore the default.
Syntax
dot1x auth-fail vlan authfail-vlan-id
undo dot1x auth-fail vlan
Default
No 802.1X Auth-Fail VLAN exists on a port.
Views
Ethernet interface view
Predefined user roles
network-admin
Parameters
authfail-vlan-id: Specifies the ID of the 802.1X Auth-Fail VLAN on the port. The value range for the VLAN ID is 1 to 4094. Make sure the VLAN has been created.
Usage guidelines
An 802.1X Auth-Fail VLAN accommodates users that have failed 802.1X authentication for any reasons other than unreachable servers. Users in the Auth-Fail VLAN can access a limited set of network resources.
You cannot specify a VLAN as both a super VLAN and an 802.1X Auth-Fail VLAN on a port. For more information about super VLANs, see Layer 2—LAN Switching Configuration Guide.
To delete a VLAN that has been configured as an 802.1X Auth-Fail VLAN, you must first use the undo dot1x auth-fail vlan command.
Examples
# Configure VLAN 100 as the Auth-Fail VLAN on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x auth-fail vlan 100
Related commands
display dot1x
dot1x critical vlan
Use dot1x critical vlan to configure an 802.1X critical VLAN on a port.
Use undo dot1x critical vlan to restore the default.
Syntax
dot1x critical vlan critical-vlan-id
undo dot1x critical vlan
Default
No 802.1X critical VLAN exists on a port.
Views
Ethernet interface view
Predefined user roles
network-admin
Parameters
critical-vlan-id: Specifies the ID of the 802.1X critical VLAN on the port. The value range for the VLAN ID is 1 to 4094. Make sure the VLAN has been created.
Usage guidelines
An 802.1X critical VLAN accommodates users that fail 802.1X authentication because all the RADIUS servers in their ISP domains are unreachable. Users in the critical VLAN can access a limited set of network resources depending on the configuration.
You cannot specify a VLAN as both a super VLAN and an 802.1X critical VLAN on a port. For more information about super VLANs, see Layer 2—LAN Switching Configuration Guide.
To delete a VLAN that has been configured as an 802.1X critical VLAN, you must first use the undo dot1x critical vlan command.
Examples
# Specify VLAN 100 as the 802.1X critical VLAN on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x critical vlan 100
Related commands
display dot1x
dot1x domain-delimiter
Use dot1x domain-delimiter to specify a set of domain name delimiters supported by the device.
Use undo dot1x domain-delimiter to restore the default.
Syntax
dot1x domain-delimiter string
undo dot1x domain-delimiter
Default
The device supports only the at sign (@) delimiter for 802.1X users.
Views
System view
Predefined user roles
network-admin
Parameters
string: Specifies a set of 1 to 16 domain name delimiters for 802.1X users. No space is required between delimiters. Available delimiters include the at sign (@), backslash (\), dot (.), and forward slash (/). If you want to use backslash (\) as the domain name delimiter, you must enter the escape character (\) along with the backslash (\) sign.
Usage guidelines
Any character in the configured set can be used as the domain name delimiter for 802.1X authentication users. Usernames that include domain names can use the format of username@domain-name, domain-name\username, username.domain-name, or username/domain-name.
The delimiter set you configured overrides the default setting. If the at sign (@) is not included in the delimiter set, the device does not support the 802.1X users that use this sign as the domain name delimiter.
If a username string contains multiple configured delimiters, the device takes the rightmost delimiter in the username string as the domain name delimiter. For example, if you configure the forward slash (/), dot (.), and backslash (\) as delimiters, the domain name delimiter for the username string 121.123/22\@abc is the backslash (\). The username is @abc and the domain name is 121.123/22.
Examples
# Specify the at sign (@) and forward slash (/) as domain name delimiters.
<Sysname> system-view
[Sysname] dot1x domain-delimiter @/
Related commands
display dot1x
dot1x guest-vlan
Use dot1x guest-vlan to configure an 802.1X guest VLAN on a port.
Use undo dot1x guest-vlan to restore the default.
Syntax
dot1x guest-vlan guest-vlan-id
undo dot1x guest-vlan
Default
No 802.1X guest VLAN exists on a port.
Views
Ethernet interface view
Predefined user roles
network-admin
Parameters
guest-vlan-id: Specifies the ID of the 802.1X guest VLAN. The value range for the VLAN ID is 1 to 4094. Make sure the VLAN has been created.
Usage guidelines
An 802.1X guest VLAN accommodates users that have not performed 802.1X authentication. In the guest VLAN, users can access a limited set of network resources, such as a software server, to download anti-virus software and system patches.
You cannot specify a VLAN as both a super VLAN and an 802.1X guest VLAN on a port. For more information about super VLANs, see Layer 2—LAN Switching Configuration Guide.
To delete a VLAN that has been configured as a guest VLAN, you must use the undo dot1x guest-vlan command first.
Examples
# Specify VLAN 100 as the 802.1X guest VLAN on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x guest-vlan 100
Related commands
display dot1x
dot1x handshake
Use dot1x handshake to enable the online user handshake feature.
Use undo dot1x handshake to disable the online user handshake feature.
Syntax
dot1x handshake
undo dot1x handshake
Default
The online user handshake feature is disabled.
Views
Ethernet interface view
Predefined user roles
network-admin
Usage guidelines
The online user handshake feature enables the device to periodically send EAP-Request/Identity packets to the client for verifying the connectivity status of online 802.1X users. The device sets a user to the offline state if it does not receive an EAP-Response/Identity packet from the user after making the maximum attempts within the handshake period. To set the handshake timer, use the dot1x timer handshake-period command. To set the maximum handshake attempts, use the dot1x retry command.
Examples
# Enable the online user handshake feature on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x handshake
Related commands
display dot1x
dot1x timer handshake-period
dot1x retry
dot1x handshake reply enable
Use dot1x handshake reply enable to enable the 802.1X online user handshake reply feature.
Use undo dot1x handshake reply enable to disable the 802.1X online user handshake reply feature.
Syntax
dot1x handshake reply enable
undo dot1x handshake reply enable
Default
The 802.1X online user handshake reply feature is disabled.
Views
Ethernet interface view
Predefined user roles
network-admin
Usage guidelines
This command enables the device to reply to 802.1X clients' EAP-Response/Identity packets with EAP-Success packets during the online handshake process.
Use this command only if 802.1X clients will go offline without receiving EAP-Success packets from the device.
Examples
# Enable the 802.1X online user handshake reply feature on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x handshake reply enable
Related commands
dot1x handshake
dot1x handshake secure
Use dot1x handshake secure to enable the online user handshake security feature.
Use undo dot1x handshake secure to disable the online user handshake security feature.
Syntax
dot1x handshake secure
undo dot1x handshake secure
Default
The online user handshake security feature is disabled.
Views
Ethernet interface view
Predefined user roles
network-admin
Usage guidelines
The online user handshake security feature enables the device to prevent users from using illegal client software.
The feature is implemented based on the online user handshake feature. To bring the security function into effect, make sure the online user handshake feature is enabled.
The online user handshake security feature takes effect only on the network where the iNode client and IMC server are used.
Examples
# Enable the online user handshake security feature on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x handshake secure
Related commands
display dot1x
dot1x handshake
dot1x mandatory-domain
Use dot1x mandatory-domain to specify a mandatory 802.1X authentication domain on a port.
Use undo dot1x mandatory-domain to restore the default.
Syntax
dot1x mandatory-domain domain-name
undo dot1x mandatory-domain
Default
No mandatory 802.1X authentication domain is specified on a port.
Views
Ethernet interface view
Predefined user roles
network-admin
Parameters
domain-name: Specifies the ISP domain name, a case-insensitive string of 1 to 255 characters.
Usage guidelines
When the system authenticates an 802.1X user trying to access a port, it selects an authentication domain in the following order:
1. Mandatory domain.
2. ISP domain specified in the username.
3. Default ISP domain.
Examples
# Specify my-domain as the mandatory authentication domain for 802.1X users on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x mandatory-domain my-domain
Related commands
display dot1x
dot1x max-user
Use dot1x max-user to set the maximum number of concurrent 802.1X users on a port.
Use undo dot1x max-user to restore the default.
Syntax
dot1x max-user max-number
undo dot1x max-user
Default
The default is 4294967295.
Views
Ethernet interface view
Predefined user roles
network-admin
Parameters
max-number: Sets the maximum number of concurrent 802.1X users on a port. The value range for this argument is 1 to 4294967295.
Usage guidelines
Set the maximum number of concurrent 802.1X users on a port to prevent the system resources from being overused. When the maximum number is reached, the port denies subsequent 802.1X users.
Examples
# Set the maximum number of concurrent 802.1X users to 32 on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x max-user 32
Related commands
display dot1x
dot1x multicast-trigger
Use dot1x multicast-trigger to enable the 802.1X multicast trigger feature.
Use undo dot1x multicast-trigger to disable the 802.1X multicast trigger feature.
Syntax
dot1x multicast-trigger
undo dot1x multicast-trigger
Default
The 802.1X multicast trigger feature is enabled.
Views
Ethernet interface view
Predefined user roles
network-admin
Usage guidelines
The multicast trigger feature enables the device to act as the initiator. The device periodically multicasts EAP-Request/Identity packets out of a port to detect 802.1X clients and trigger authentication. You can use the dot1x timer tx-period command to set the interval for sending multicast EAP-Request/Identity packets.
Examples
# Enable the multicast trigger feature on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x multicast-trigger
Related commands
display dot1x
dot1x timer tx-period
dot1x unicast-trigger
dot1x port-control
Use dot1x port-control to set the authorization state of the port.
Use undo dot1x port-control to restore the default.
Syntax
dot1x port-control { authorized-force | auto | unauthorized-force }
undo dot1x port-control
Default
The default port authorization state is auto.
Views
Ethernet interface view
Predefined user roles
network-admin
Parameters
authorized-force: Places the port in authorized state, enabling users on the port to access the network without authentication.
auto: Places the port initially in unauthorized state to allow only EAPOL packets to pass, and places the port in authorized state after a user passes authentication. You can use this option in most scenarios.
unauthorized-force: Places the port in unauthorized state, denying any access requests from users on the port.
Usage guidelines
Use this command to control network access authorization on a port basis.
Examples
# Set the authorization state of GigabitEthernet 3/1/1 to unauthorized-force.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x port-control unauthorized-force
Related commands
display dot1x
dot1x port-method portbased
Use dot1x port-method portbased to enable port-based access control.
Use undo dot1x port-method to disable port-based access control.
Syntax
dot1x port-method portbased
undo dot1x port-method
Default
Port-based access control is disabled.
Views
Ethernet interface view
Predefined user roles
network-admin
Usage guidelines
To use 802.1X, you must enable port-based access control.
Once an 802.1X user passes authentication on a port that uses port-based access control, any subsequent user can access the network through the port without authentication. When the authenticated user logs off, all other users are logged off.
Examples
# Enable port-based access control on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x port-method portbased
Related commands
display dot1x
dot1x quiet-period
Use dot1x quiet-period to enable the quiet timer.
Use undo dot1x quiet-period to disable the quiet timer.
Syntax
dot1x quiet-period
undo dot1x quiet-period
Default
The quiet timer is disabled.
Views
System view
Predefined user roles
network-admin
Usage guidelines
When a client fails 802.1X authentication, the device must wait a period of time before it can process authentication requests from the client. You can use the dot1x timer quiet-period command to set the quiet timer.
Examples
# Enable the quiet timer and set the quiet timer to 100 seconds.
<Sysname> system-view
[Sysname] dot1x quiet-period
[Sysname] dot1x timer quiet-period 100
Related commands
display dot1x
dot1x timer
dot1x retry
Use dot1x retry to set the maximum number of attempts for sending an authentication request to a client.
Use undo dot1x retry to restore the default.
Syntax
dot1x retry retries
undo dot1x retry
Default
A maximum of two attempts are made to send an authentication request to a client.
Views
System view
Predefined user roles
network-admin
Parameters
retries: Specifies the maximum number of attempts for sending an authentication request to a client. The value range is 1 to 10.
Usage guidelines
The access device retransmits an authentication request to a client in any of the following situations:
· The device does not receive any responses from the client within the username request timeout interval. The timer is set by using the dot1x timer tx-period tx-period-value command for the EAP-Request/Identity packet.
· The device does not receive any responses from the client within the client timeout interval. The timer is set by using the dot1x timer supp-timeout supp-timeout-value command for the EAP-Request/MD5-Challenge packet.
The access device stops retransmitting the request, if it has made the maximum number of request transmission attempts but still received no response.
Examples
# Set the maximum number of attempts to 9 for sending an authentication request to a client.
<Sysname> system-view
[Sysname] dot1x retry 9
Related commands
display dot1x
dot1x timer
dot1x timer
Use dot1x timer to set an 802.1X timer.
Use undo dot1x timer to restore the default of an 802.1X timer.
Syntax
dot1x timer { handshake-period handshake-period-value | quiet-period quiet-period-value | server-timeout server-timeout-value | supp-timeout supp-timeout-value | tx-period tx-period-value }
undo dot1x timer { handshake-period | quiet-period | server-timeout | supp-timeout | tx-period }
Default
The following 802.1X timer settings apply:
· Handshake timer—15 seconds.
· Quiet timer—60 seconds.
· Server timeout timer—100 seconds.
· Client timeout timer—30 seconds.
· Username request timeout timer—30 seconds.
Views
System view
Predefined user roles
network-admin
Parameters
handshake-period handshake-period-value: Sets the handshake timer in seconds. The value range for the handshake-period-value argument is 5 to 1024.
quiet-period quiet-period-value: Sets the quiet timer in seconds. The value range for the quiet-period-value argument is 10 to 120.
server-timeout server-timeout-value: Sets the server timeout timer in seconds. The value range for the server-timeout-value argument is 100 to 300.
supp-timeout supp-timeout-value: Sets the client timeout timer in seconds. The value range for the supp-timeout-value argument is 1 to 120.
tx-period tx-period-value: Sets the username request timeout timer in seconds. The value range for the tx-period-value argument is 1 to 120.
Usage guidelines
In most cases, the default settings are sufficient. You can edit the timers, depending on the network conditions.
· In a low-speed network, increase the client timeout timer.
· In a vulnerable network, set the quiet timer to a high value.
· In a high-performance network with quick authentication response, set the quiet timer to a low value.
· In a network with authentication servers of different performance, adjust the server timeout timer.
The network device uses the following 802.1X timers:
· Handshake timer (handshake-period)—Sets the interval at which the access device sends client handshake requests to check the online status of a client that has passed authentication. If the device does not receive a response after sending the maximum number of handshake requests, it considers that the client has logged off.
· Quiet timer (quiet-period)—Starts when a client fails authentication. The access device must wait the time period before it can process the authentication attempts from the client.
· Server timeout timer (server-timeout)—Starts when the access device sends a RADIUS Access-Request packet to the authentication server. If no response is received when this timer expires, the 802.1X authentication fails.
· Client timeout timer (supp-timeout)—Starts when the access device sends an EAP-Request/MD5-Challenge packet to a client. If no response is received when this timer expires, the access device retransmits the request to the client.
· Username request timeout timer (tx-period)—Starts when the device sends an EAP-Request/Identity packet to a client in response to an authentication request. If the device does not receive a response before this timer expires, it retransmits the request. The timer also sets the interval at which the network device sends multicast EAP-Request/Identity packets to detect clients that cannot actively request authentication.
A timer change takes effect immediately on the device.
Examples
# Set the server timeout timer to 150 seconds.
<Sysname> system-view
[Sysname] dot1x timer server-timeout 150
Related commands
display dot1x
dot1x unicast-trigger
Use dot1x unicast-trigger to enable the 802.1X unicast trigger feature.
Use undo dot1x unicast-trigger to disable the 802.1X unicast trigger feature.
Syntax
dot1x unicast-trigger
undo dot1x unicast-trigger
Default
The 802.1X unicast trigger feature is disabled.
Views
Ethernet interface view
Predefined user roles
network-admin
Usage guidelines
The unicast trigger feature enables the access device to initiate 802.1X authentication when the device receives a data frame from an unknown source MAC address. The device sends a unicast EAP-Request/Identity packet to the unknown source MAC address. It will retransmit the packet if it does not receive any responses within a period of time (set by using the dot1x timer tx-period command). This process continues until the maximum number of request attempts (set by using the dot1x retry command) is reached.
As a best practice, do not use the unicast trigger on a port that performs port-based access control. If you do so, users on that port might fail to come online.
Examples
# Enable the unicast trigger feature on GigabitEthernet 3/1/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 3/1/1
[Sysname-GigabitEthernet3/1/1] dot1x unicast-trigger
Related commands
display dot1x
dot1x multicast-trigger
dot1x port-method
dot1x retry
dot1x timer
reset dot1x statistics
Use reset dot1x statistics to clear 802.1X statistics.
Syntax
reset dot1x statistics [ interface interface-type interface-number ]
Views
User view
Predefined user roles
network-admin
Parameters
interface interface-type interface-number: Specifies a port by its type and number. If you do not specify a port, this command clears 802.1X statistics on all ports.
Examples
# Clear 802.1X statistics on GigabitEthernet 3/1/1.
<Sysname> reset dot1x statistics interface gigabitethernet 3/1/1
display dot1x
