Login
- Table of Contents
-
- 13-User Access and Authentication Configuration Guide
- 00-Preface
- 01-WLAN authentication configuration
- 02-WLAN IP snooping configuration
- 03-AAA configuration
- 04-802.1X configuration
- 05-802.1X client configuration
- 06-MAC authentication configuration
- 07-Port security configuration
- 08-Portal configuration
- 09-User identification configuration
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 04-802.1X configuration | 270.71 KB |
Contents
Controlled/uncontrolled port and port authorization status
802.1X authentication procedures
802.1X authentication initiation
Periodic 802.1X reauthentication
Restrictions and guidelines: 802.1X configuration
Enabling EAP relay or EAP termination
Setting the port authorization state
Specifying an access control method
Specifying a mandatory authentication domain on a port
Setting the 802.1X authentication timeout timers
Configuring 802.1X reauthentication
Configuring the authentication trigger feature
Setting the maximum number of concurrent 802.1X users on a port
Setting the maximum number of authentication request attempts
Configuring online user handshake
Specifying supported domain name delimiters
Configuring the EAD assistant feature
Display and maintenance commands for 802.1X
EAD assistant URL redirection failure
802.1X overview
About the 802.1X protocol
802.1X is a port-based network access control protocol widely used on Ethernet networks. The protocol controls network access by authenticating the devices connected to 802.1X-enabled LAN ports.
802.1X architecture
802.1X operates in the client/server model. As shown in Figure 1, 802.1X authentication includes the following entities:
· Client (supplicant)—A user terminal seeking access to the LAN. The terminal must have 802.1X software to authenticate to the access device.
· Access device (authenticator)—Authenticates the client to control access to the LAN. In a typical 802.1X environment, the access device uses an authentication server to perform authentication.
· Authentication server—Provides authentication services for the access device. The authentication server first authenticates 802.1X clients by using the data sent from the access device. Then, the server returns the authentication results to the access device to make access decisions. The authentication server is typically a RADIUS server. In a small LAN, you can use the access device as the authentication server.
Controlled/uncontrolled port and port authorization status
802.1X defines two logical ports for the network access port: controlled port and uncontrolled port. Any packet arriving at the network access port is visible to both logical ports.
· Uncontrolled port—Is always open to receive and transmit authentication packets.
· Controlled port—Filters packets depending on the port state.
¡ Authorized state—The controlled port is in authorized state when the client has passed authentication. The port allows traffic to pass through.
¡ Unauthorized state—The port is in unauthorized state when the client has failed authentication. The port controls traffic by using one of the following methods:
- Performs bidirectional traffic control to deny traffic to and from the client.
- Performs unidirectional traffic control to deny traffic from the client. The device supports only unidirectional traffic control.
Figure 2 Authorization state of a controlled port
Packet exchange methods
802.1X uses the Extensible Authentication Protocol (EAP) to transport authentication information for the client, the access device, and the authentication server. EAP is an authentication framework that uses the client/server model. The framework supports a variety of authentication methods, including MD5-Challenge, EAP-Transport Layer Security (EAP-TLS), and Protected EAP (PEAP).
802.1X defines EAP over LAN (EAPOL) for passing EAP packets between the client and the access device over a wired or wireless LAN. Between the access device and the authentication server, 802.1X delivers authentication information by either EAP relay or EAP termination.
EAP relay
EAP relay is defined in IEEE 802.1X. In this mode, the network device uses EAP over RADIUS (EAPOR) packets to send authentication information to the RADIUS server, as shown in Figure 3.
In EAP relay mode, the client must use the same authentication method as the RADIUS server. On the access device, you only need to use the dot1x authentication-method eap command to enable EAP relay.
EAP termination
As shown in Figure 4, the access device performs the following operations in EAP termination mode:
1. Terminates the EAP packets received from the client.
2. Encapsulates the client authentication information in standard RADIUS packets.
3. Uses PAP or CHAP to authenticate to the RADIUS server.
Comparing EAP relay and EAP termination
|
Packet exchange method |
Benefits |
Limitations |
|
EAP relay |
· Supports various EAP authentication methods. · The configuration and processing are simple on the access device. |
The RADIUS server must support the EAP-Message and Message-Authenticator attributes, and the EAP authentication method used by the client. |
|
EAP termination |
Works with any RADIUS server that supports PAP or CHAP authentication. |
· Supports only the following EAP authentication methods: ¡ MD5-Challenge EAP authentication. ¡ The username and password EAP authentication initiated by an iNode 802.1X client. · The processing is complex on the access device. |
Packet formats
EAP packet format
Figure 5 shows the EAP packet format.
· Code—Type of the EAP packet. Options include Request (1), Response (2), Success (3), or Failure (4).
· Identifier—Used for matching Responses with Requests.
· Length—Length (in bytes) of the EAP packet. The EAP packet length is the sum of the Code, Identifier, Length, and Data fields.
· Data—Content of the EAP packet. This field appears only in a Request or Response EAP packet. The Data field contains the request type (or the response type) and the type data. Type 1 (Identity) and type 4 (MD5-Challenge) are two examples for the type field.
EAPOL packet format
Figure 6 shows the EAPOL packet format.
· PAE Ethernet type—Protocol type. It takes the value 0x888E for EAPOL.
· Protocol version—The EAPOL protocol version used by the EAPOL packet sender.
· Type—Type of the EAPOL packet. Table 1 lists the types of EAPOL packets supported by the 802.1X implementation of the device.
Table 1 Types of EAPOL packets
|
Value |
Type |
Description |
|
0x00 |
EAP-Packet |
The client and the access device uses EAP-Packets to transport authentication information. |
|
0x01 |
EAPOL-Start |
The client sends an EAPOL-Start message to initiate 802.1X authentication to the access device. |
|
0x02 |
EAPOL-Logoff |
The client sends an EAPOL-Logoff message to tell the access device that the client is logging off. |
· Length—Data length in bytes, or length of the Packet body. If packet type is EAPOL-Start or EAPOL-Logoff, this field is set to 0, and no Packet body field follows.
· Packet body—Content of the packet. When the EAPOL packet type is EAP-Packet, the Packet body field contains an EAP packet.
EAP over RADIUS
RADIUS adds two attributes, EAP-Message and Message-Authenticator, for supporting EAP authentication. For more information about the RADIUS packet format, see "Configuring AAA."
RADIUS encapsulates EAP packets in the EAP-Message attribute, as shown in Figure 7. The Type field takes 79, and the Value field can be up to 253 bytes. If an EAP packet is longer than 253 bytes, RADIUS encapsulates it in multiple EAP-Message attributes.
Figure 7 EAP-Message attribute format
As shown in Figure 8, RADIUS includes the Message-Authenticator attribute in all packets that have an EAP-Message attribute to check their integrity. The packet receiver drops the packet if the calculated packet integrity checksum is different from the Message-Authenticator attribute value. The Message-Authenticator prevents EAP authentication packets from being tampered with during EAP authentication.
Figure 8 Message-Authenticator attribute format
802.1X authentication procedures
802.1X authentication has two methods: EAP relay and EAP termination. You choose either mode depending on support of the RADIUS server for EAP packets and EAP authentication methods.
EAP relay
Figure 9 shows the basic 802.1X authentication procedure in EAP relay mode, assuming that MD5-Challenge EAP authentication is used.
Figure 9 802.1X authentication procedure in EAP relay mode
The following steps describe the 802.1X authentication procedure:
1. When a user launches the 802.1X client and enters a registered username and password, the 802.1X client sends an EAPOL-Start packet to the access device.
2. The access device responds with an EAP-Request/Identity packet to ask for the client username.
3. In response to the EAP-Request/Identity packet, the client sends the username in an EAP-Response/Identity packet to the access device.
4. The access device relays the EAP-Response/Identity packet in a RADIUS Access-Request packet to the authentication server.
5. The authentication server uses the identity information in the RADIUS Access-Request to search its user database. If a matching entry is found, the server uses a randomly generated challenge (EAP-Request/MD5-Challenge) to encrypt the password in the entry. Then, the server sends the challenge in a RADIUS Access-Challenge packet to the access device.
6. The access device transmits the EAP-Request/MD5-Challenge packet to the client.
7. The client uses the received challenge to encrypt the password, and sends the encrypted password in an EAP-Response/MD5-Challenge packet to the access device.
8. The access device relays the EAP-Response/MD5-Challenge packet in a RADIUS Access-Request packet to the authentication server.
9. The authentication server compares the received encrypted password with the encrypted password it generated at step 5. If the two passwords are identical, the server considers the client valid and sends a RADIUS Access-Accept packet to the access device.
10. Upon receiving the RADIUS Access-Accept packet, the access device performs the following operations:
a. Sends an EAP-Success packet to the client.
b. Sets the controlled port in authorized state.
The client can access the network.
11. After the client comes online, the access device periodically sends handshake requests to check whether the client is still online. By default, if two consecutive handshake attempts fail, the device logs off the client.
13. The client can also send an EAPOL-Logoff packet to ask the access device for a logoff.
14. In response to the EAPOL-Logoff packet, the access device changes the status of the controlled port from authorized to unauthorized. Then, the access device sends an EAP-Failure packet to the client.
EAP termination
Figure 10 shows the basic 802.1X authentication procedure in EAP termination mode, assuming that CHAP authentication is used.
Figure 10 802.1X authentication procedure in EAP termination mode
In EAP termination mode, the access device rather than the authentication server generates an MD5 challenge for password encryption. The access device then sends the MD5 challenge together with the username and encrypted password in a standard RADIUS packet to the RADIUS server.
802.1X authentication initiation
Both the 802.1X client and the access device can initiate 802.1X authentication.
802.1X client as the initiator
The client sends an EAPOL-Start packet to the access device to initiate 802.1X authentication. The destination MAC address of the packet is the IEEE 802.1X specified multicast address 01-80-C2-00-00-03 or the broadcast MAC address. If any intermediate device between the client and the authentication server does not support the multicast address, you must use an 802.1X client that can send broadcast EAPOL-Start packets. For example, you can use the iNode 802.1X client.
Access device as the initiator
If the client cannot send EAPOL-Start packets, configure the access device to initiate authentication. One example is the 802.1X client available with Windows XP.
The access device supports the multicast trigger mode. In this mode, the access device multicasts EAP-Request/Identity packets to initiate 802.1X authentication at the identity request interval.
The username request timeout timer sets the identity request interval for the multicast trigger.
Access control methods
H3C implements port-based access control as defined in the 802.1X protocol, and extends the protocol to support MAC-based access control.
· Port-based access control—Once an 802.1X user passes authentication on a port, any subsequent user can access the network through the port without authentication. When the authenticated user logs off, all other users are logged off.
· MAC-based access control—Each user is separately authenticated on a port. When a user logs off, no other online users are affected.
ACL assignment
You can specify an ACL for an 802.1X user on the authentication server to control the user's access to network resources. After the user passes 802.1X authentication, the authentication server assigns the ACL to the user access port of the user. Then, the port permits or drops the matching traffic for the user depending on the rules configured in the ACL.
The authentication server can be the local access device or a RADIUS server. In either case, the server only specifies the ACL number. You must create the ACL and configure its rules on the access device.
To change the access control criteria for the user, you can use one of the following methods:
· Modify ACL rules on the access device.
· Specify another authorization ACL on the authentication server.
The supported authorization ACLs include the following types:
· Basic ACLs, which are numbered in the range of 2000 to 2999.
· Advanced ACLs, which are numbered in the range of 3000 to 3999.
· Layer 2 ACLs, which are numbered in the range of 4000 to 4999.
For an authorization ACL to take effect, make sure the ACL exists with rules and none of the rules contains the counting, established, fragment, source-mac, or logging keyword.
For more information about ACLs, see Security Command Reference.
User profile assignment
You can specify a user profile for an 802.1X user on the authentication server to control the user's access to network resources. After the user passes 802.1X authentication, the authentication server assigns the user profile to the user for filtering traffic.
The authentication server can be the local access device or a RADIUS server. In either case, the server only specifies the user profile name. You must configure the user profile on the access device.
To change the user's access permissions, you can use one of the following methods:
· Modify the user profile configuration on the access device.
· Specify another user profile for the user on the authentication server.
Periodic 802.1X reauthentication
Periodic 802.1X reauthentication tracks the connection status of online users and updates the authorization attributes (such as ACL and VLAN) assigned by the server.
The device reauthenticates online 802.1X users at the periodic reauthentication interval when the periodic online user reauthentication feature is enabled. The interval is controlled by a timer and the timer is user configurable. A change to the periodic reauthentication timer applies to online users only after the old timer expires and the users pass authentication.
The server-assigned session timeout timer (Session-Timeout attribute) and termination action (Termination-Action attribute) together can affect the periodic online user reauthentication feature. To display the server-assigned Session-Timeout and Termination-Action attributes, use the display dot1x connection command.
· If the termination action is Default (logoff), periodic online user reauthentication on the device takes effect only when the periodic reauthentication timer is shorter than the session timeout timer.
· If the termination action is Radius-request, the periodic online user reauthentication settings on the device do not take effect. The device reauthenticates the online 802.1X users after the session timeout timer expires.
If no session timeout timer is assigned by the server, whether the device performs periodic 802.1X reauthentication depends on the periodic reauthentication configuration on the device. Support for the assignment of Session-Timeout and Termination-Action attributes depends on the server model.
By default, the device logs off online 802.1X users if no server is reachable for 802.1X reauthentication. The keep-online feature keeps authenticated 802.1X users online when no server is reachable for 802.1X reauthentication.
The VLANs assigned to an online user before and after reauthentication can be the same or different.
EAD assistant
Endpoint Admission Defense (EAD) is an H3C integrated endpoint access control solution to improve the threat defensive capability of a network. The solution enables the security client, security policy server, access device, and third-party server to operate together. If a terminal device seeks to access an EAD network, it must have an EAD client, which performs 802.1X authentication.
The EAD assistant feature enables the access device to redirect the HTTP requests of a user to a redirect URL for downloading and installing an EAD client. This feature eliminates the administrative task to deploy EAD clients.
EAD assistant is implemented by the following functionality:
· Free IP.
A free IP is a freely accessible network segment, which has a limited set of network resources such as software and DHCP servers. To ensure security strategy compliance, an unauthenticated user can access only this segment to perform operations. For example, the user can download EAD client from a software server or obtain a dynamic IP address from a DHCP server.
· Redirect URL.
If an unauthenticated 802.1X user is using a Web browser to access the network, EAD assistant redirects the network access requests of the user to a specific URL. For example, you can use this feature to redirect the user to the EAD client software download page.
The EAD assistant feature creates an ACL-based EAD rule automatically to open access to the redirect URL for each redirected user.
EAD rules are implemented by using ACL resources. When the EAD rule timer expires or the user passes authentication, the rule is removed. If users fail to download EAD client or fail to pass authentication before the timer expires, they must reconnect to the network to access the free IP.
SmartOn
The SmartOn feature was developed to support the NEC 802.1X client.
As shown in Figure 11, the access device performs SmartOn authentication before 802.1X authentication. The following shows the authentication process:
1. When a SmartOn-enabled port receives an EAPOL-Start packet from an 802.1X client, it sends a unicast EAP-Request/Notification packet to the client for SmartOn authentication.
2. Upon receiving an EAP-Response/Notification from the client, the device compares the switch ID and password in the packet with the switch ID and password configured on the device.
¡ If they are the same, 802.1X authentication can continue.
¡ If they do not match, SmartOn authentication fails. The access device stops 802.1X authentication for the client.
Figure 11 802.1X authentication process with the SmartOn feature
If the user attempts to use another 802.1X client for authentication, it will fail SmartOn authentication. The access device stops 802.1X authentication for the user.
|
|
NOTE: After you install the SmartOn client software, add two values QX_ID and QX_PASSWORD to the Windows registry key [HKEY_LOCAL_MACHINE\SOFTWARE\Soliton Systems K.K.\SmartOn Client\Clients\1XGate]. Specify the switch ID and password for the QX_ID and QX_PASSWORD, respectively. The switch ID and password must be the same as the switch ID and password configured on the device. |
Configuring 802.1X
Restrictions and guidelines: 802.1X configuration
You can configure the port security feature to perform 802.1X. Port security combines and extends 802.1X and MAC authentication. It applies to a network (a WLAN, for example) that requires different authentication methods for different users on a port. For more information about the port security feature, see "Configuring port security."
802.1X tasks at a glance
To configure 802.1X authentication, perform the following tasks:
2. Configuring basic 802.1X features
¡ Enabling EAP relay or EAP termination
¡ Setting the port authorization state
¡ Specifying an access control method
¡ (Optional.) Specifying a mandatory authentication domain on a port
¡ (Optional.) Setting the 802.1X authentication timeout timers
¡ (Optional.) Configuring 802.1X reauthentication
¡ (Optional.) Setting the quiet timer
3. (Optional.) Configuring other 802.1X features
¡ Configuring the authentication trigger feature
Perform this task when 802.1X clients cannot initiate authentication.
¡ Setting the maximum number of concurrent 802.1X users on a port
¡ Setting the maximum number of authentication request attempts
¡ Configuring online user handshake
¡ Specifying supported domain name delimiters
¡ Configuring the EAD assistant feature
Prerequisites for 802.1X
Before you configure 802.1X, complete the following tasks:
· Configure an ISP domain and AAA scheme (local or RADIUS authentication) for 802.1X users.
· If RADIUS authentication is used, create user accounts on the RADIUS server.
· If local authentication is used, create local user accounts on the access device and set the service type to lan-access.
Enabling 802.1X
Restrictions and guidelines
For 802.1X to take effect on a port, you must enable it both globally and on the port.
Do not enable 802.1X on a port that is in a link aggregation group.
Procedure
1. Enter system view.
system-view
2. Enable 802.1X globally.
dot1x
By default, 802.1X is disabled globally.
3. Enter interface view.
interface interface-type interface-number
4. Enable 802.1X on a port.
dot1x
By default, 802.1X is disabled on a port.
Enabling EAP relay or EAP termination
About this task
Consider the following factors to select a proper EAP mode:
· Support of the RADIUS server for EAP packets.
· Authentication methods supported by the 802.1X client and the RADIUS server.
Restrictions and guidelines
· If EAP relay mode is used, the user-name-format command configured in RADIUS scheme view does not take effect. The access device sends the authentication data from the client to the server without any modification. For more information about the user-name-format command, see AAA commands in User Access and Authentication Command Reference.
· You can use both EAP termination and EAP relay in any of the following situations:
¡ The client is using only MD5-Challenge EAP authentication. If EAP termination is used, you must enable CHAP authentication on the access device.
¡ The client is an iNode 802.1X client and initiates only the username and password EAP authentication. If EAP termination is used, you can enable either PAP or CHAP authentication on the access device. However, for the purpose of security, you must use CHAP authentication on the access device.
· To use EAP-TLS, PEAP, or any other EAP authentication methods, you must use EAP relay. When you make your decision, see "Comparing EAP relay and EAP termination" for help.
Procedure
1. Enter system view.
system-view
2. Configure EAP relay or EAP termination.
dot1x authentication-method { chap | eap | pap }
By default, the access device performs EAP termination and uses CHAP to communicate with the RADIUS server.
Setting the port authorization state
About this task
The port authorization state determines whether the client is granted access to the network. You can control the following authorization states of a port:
· Authorized—Places the port in the authorized state, enabling users on the port to access the network without authentication.
· Unauthorized—Places the port in the unauthorized state, denying any access requests from users on the port.
· Auto—Places the port initially in unauthorized state to allow only EAPOL packets to pass. After a user passes authentication, sets the port in the authorized state to allow access to the network. You can use this option in most scenarios.
Procedure
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
3. Set the port authorization state.
dot1x port-control { authorized-force | auto | unauthorized-force }
By default, the auto state applies.
Specifying an access control method
About this task
The device supports port-based and MAC-based access control methods.
Procedure
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
3. Specify an access control method.
dot1x port-method { macbased | portbased }
By default, MAC-based access control applies.
Specifying a mandatory authentication domain on a port
About this task
You can place all 802.1X users in a mandatory authentication domain for authentication, authorization, and accounting on a port. No user can use an account in any other domain to access the network through the port. The implementation of a mandatory authentication domain enhances the flexibility of 802.1X access control deployment.
Procedure
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
3. Specify a mandatory 802.1X authentication domain on the port.
dot1x mandatory-domain domain-name
By default, no mandatory 802.1X authentication domain is specified.
Setting the 802.1X authentication timeout timers
About this task
The network device uses the following 802.1X authentication timeout timers:
· Client timeout timer—Starts when the access device sends an EAP-Request/MD5-Challenge packet to a client. If no response is received when this timer expires, the access device retransmits the request to the client.
· Server timeout timer—Starts when the access device sends a RADIUS Access-Request packet to the authentication server. If no response is received when this timer expires, 802.1X authentication fails.
Restrictions and guidelines
In most cases, the default settings are sufficient. You can edit the timers, depending on the network conditions.
· In a low-speed network, increase the client timeout timer.
· In a network with authentication servers of different performance, adjust the server timeout timer.
Procedure
1. Enter system view.
system-view
2. Set the client timeout timer.
dot1x timer supp-timeout supp-timeout-value
The default is 30 seconds.
3. Set the server timeout timer.
dot1x timer server-timeout server-timeout-value
The default is 100 seconds.
Configuring 802.1X reauthentication
Restrictions and guidelines
Any modification to the mandatory authentication domain or EAP message handling method setting does not affect the reauthentication of online 802.1X users. The modified setting takes effect only on 802.1X users that come online after the modification.
Procedure
1. Enter system view.
system-view
2. (Optional.) Set the periodic reauthentication timer.
dot1x timer reauth-period reauth-period-value
The default setting is 3600 seconds.
3. Enter interface view.
interface interface-type interface-number
4. Enable periodic online user reauthentication.
dot1x re-authenticate
By default, the feature is disabled.
5. (Optional.) Enable the keep-online feature for 802.1X users.
dot1x re-authenticate server-unreachable keep-online
By default, this feature is disabled. The device logs off online 802.1X users if no authentication server is reachable for 802.1X reauthentication.
Use the keep-online feature according to the actual network condition. In a fast-recovery network, you can use the keep-online feature to prevent 802.1X users from coming online and going offline frequently.
Setting the quiet timer
About this task
The quiet timer enables the access device to wait a period of time before it can process any authentication request from a client that has failed an 802.1X authentication.
Restrictions and guidelines
You can edit the quiet timer, depending on the network conditions.
· In a vulnerable network, set the quiet timer to a high value.
· In a high-performance network with quick authentication response, set the quiet timer to a low value.
Procedure
1. Enter system view.
system-view
2. Enable the quiet timer.
dot1x quiet-period
By default, the timer is disabled.
3. (Optional.) Set the quiet timer.
dot1x timer quiet-period quiet-period-value
The default is 60 seconds.
Configuring the authentication trigger feature
About this task
The device provides a multicast trigger on the device to initiate 802.1X authentication when 802.1X clients cannot initiate authentication. For more information about 802.1X authentication initiation, see "802.1X overview".
Restrictions and guidelines
· Enable the multicast trigger on a port when the clients attached to the port cannot send EAPOL-Start packets to initiate 802.1X authentication.
· Disable the multicast trigger in a wireless LAN. Wireless clients and the wireless module of the access device can both initiate 802.1X authentication.
Procedure
1. Enter system view.
system-view
2. (Optional.) Set the username request timeout timer.
dot1x timer tx-period tx-period-value
The default is 30 seconds.
3. Enter interface view.
interface interface-type interface-number
4. Enable the authentication trigger.
dot1x multicast-trigger
By default, the multicast trigger is enabled.
Setting the maximum number of concurrent 802.1X users on a port
About this task
Perform this task to prevent the system resources from being overused.
Procedure
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
3. Set the maximum number of concurrent 802.1X users on a port.
dot1x max-user max-number
The default is 4294967295.
Setting the maximum number of authentication request attempts
About this task
The access device retransmits an authentication request if it does not receive any responses to the request from the client within a period of time. To set the time, use the dot1x timer tx-period tx-period-value command or the dot1x timer supp-timeout supp-timeout-value command. The access device stops retransmitting the request if it has made the maximum number of request transmission attempts but still receives no response.
Procedure
1. Enter system view.
system-view
2. Set the maximum number of attempts for sending an authentication request.
dot1x retry retries
The default setting is 2.
Configuring online user handshake
About this task
The online user handshake feature checks the connectivity status of online 802.1X users. The access device sends handshake requests (EAP-Request/Identity) to online users at the interval specified by the dot1x timer handshake-period command. If the device does not receive any EAP-Response/Identity packets from an online user after it has made the maximum handshake attempts, the device sets the user to offline state. To set the maximum handshake attempts, use the dot1x retry command.
Typically, the device does not reply to 802.1X clients' EAP-Response/Identity packets with EAP-Success packets. Some 802.1X clients will go offline if they do not receive the EAP-Success packets for handshake. To avoid this issue, enable the online user handshake reply feature.
If iNode clients are deployed, you can also enable the online user handshake security feature to check authentication information in the handshake packets from clients. This feature can prevent 802.1X users that use illegal client software from bypassing iNode security check, such as dual network interface cards (NICs) detection. If a user fails the handshake security checking, the device sets the user to the offline state.
Restrictions and guidelines
· If the network has 802.1X clients that cannot exchange handshake packets with the access device, disable the online user handshake feature. This operation prevents the 802.1X connections from being incorrectly torn down.
· The SmartOn feature and the online user handshake feature are mutually exclusive. Before you enable the online user handshake feature, make sure the SmartOn feature is disabled.
· To use the online user handshake security feature, make sure the online user handshake feature is enabled.
· The online user handshake security feature takes effect only on the network where the iNode client and IMC server are used.
· Enable the online user handshake reply feature only if 802.1X clients will go offline without receiving EAP-Success packets from the device.
Procedure
1. Enter system view.
system-view
2. (Optional.) Set the handshake timer.
dot1x timer handshake-period handshake-period-value
The default is 15 seconds.
3. Enter interface view.
interface interface-type interface-number
4. Enable the online user handshake feature.
dot1x handshake
By default, the feature is enabled.
5. (Optional.) Enable the online user handshake security feature.
dot1x handshake secure
By default, the feature is disabled.
6. (Optional.) Enable the 802.1X online user handshake reply feature.
dot1x handshake reply enable
By default, the device does not reply to 802.1X clients' EAP-Response/Identity packets during the online handshake process.
Specifying supported domain name delimiters
About this task
By default, the access device supports the at sign (@) as the delimiter. You can also configure the access device to accommodate 802.1X users that use other domain name delimiters. The configurable delimiters include the at sign (@), backslash (\), dot (.), and forward slash (/). Usernames that include domain names can use the format of username@domain-name, domain-name\username, username.domain-name, or username/domain-name.
If an 802.1X username string contains multiple configured delimiters, the rightmost delimiter is the domain name delimiter. For example, if you configure the backslash (\), dot (.), and forward slash (/) as delimiters, the domain name delimiter for the username string 121.123/22\@abc is the backslash (\). The username is @abc and the domain name is 121.123/22.
Restrictions and guidelines
If a username string contains none of the delimiters, the access device authenticates the user in the mandatory or default ISP domain.
If you configure the access device to send usernames with domain names to the RADIUS server, make sure the domain delimiter can be recognized by the RADIUS server. For username format configuration, see the user-name-format command in User Access and Authentication Command Reference.
Procedure
1. Enter system view.
system-view
2. Specify a set of domain name delimiters for 802.1X users.
dot1x domain-delimiter string
By default, only the at sign (@) delimiter is supported.
Configuring the EAD assistant feature
Restrictions and guidelines
· You must disable MAC authentication and port security globally before you enable the EAD assistant feature.
· To make the EAD assistant feature take effect on an 802.1X-enabled port, you must set the port authorization mode to auto.
· When global MAC authentication or port security is enabled, the free IP does not take effect.
· To allow a user to obtain a dynamic IP address before it passes 802.1X authentication, make sure the DHCP server is on the free IP segment.
· The server that provides the redirect URL must be on the free IP accessible to unauthenticated users.
Procedure
1. Enter system view.
system-view
2. Enable the EAD assistant feature.
dot1x ead-assistant enable
By default, this feature is disabled.
3. Configure a free IP.
dot1x ead-assistant free-ip ip-address { mask-length | mask-address }
By default, no free IPs exist.
Repeat this command to configure multiple free IPs.
4. (Optional.) Configure the redirect URL if users will use Web browsers to access the network.
dot1x ead-assistant url url-string
By default, no redirect URL exists.
5. (Optional.) Set the EAD rule timer.
dot1x timer ead-timeout ead-timeout-value
The default setting is 30 minutes.
To avoid using up ACL resources when a large number of EAD users exist, you can shorten the EAD rule timer.
Configuring 802.1X SmartOn
About this task
When the device sends a unicast EAP-Request/Notification packet to the client, it starts the SmartOn client timeout timer (set by using the dot1x smarton timer supp-timeout command).
· If the device does not receive any EAP-Response/Notification packets from the client within the timeout timer, it retransmits the EAP-Request/Notification packet to the client. After the device has made the maximum retransmission attempts but received no response, it stops the 802.1X authentication process for the client.
· If the device receives an EAP-Response/Notification packet within the timer or before the maximum retransmission attempts have been made, it starts the SmartOn authentication. If the SmartOn switch ID and the MD5 digest of the SmartOn password in the packet match those on the device, 802.1X authentication continues for the client. Otherwise, the device denies the client's 802.1X authentication request.
Restrictions and guidelines
The SmartOn feature is mutually exclusive with the 802.1X online user handshake feature.
Procedure
1. Enter system view.
system-view
2. Enter interface view.
interface interface-type interface-number
3. Enable the SmartOn feature on the port.
dot1x smarton
By default, this feature is disabled.
4. Return to system view.
quit
5. Configure the SmartOn switch ID.
dot1x smarton switchid switch-string
By default, no SmartOn switch ID exists.
6. Set the SmartOn password.
dot1x smarton password { cipher | simple } string
By default, no SmartOn password exists.
7. (Optional.) Set the SmartOn client timeout timer.
dot1x smarton timer supp-timeout supp-timeout-value
The default timer is 30 seconds.
8. (Optional.) Set the maximum attempts for retransmitting an EAP-Request/Notification packet to a client.
dot1x smarton retry retries
By default, the device allows a maximum of 3 attempts for retransmitting an EAP-Request/Notification packet to a client.
Display and maintenance commands for 802.1X
Execute display commands in any view and reset commands in user view.
|
Task |
Command |
|
Display 802.1X session information, statistics, or configuration information of specified or all ports. |
display dot1x [ sessions | statistics ] [ ap ap-name [ radio radio-id ] | interface interface-type interface-number ] |
|
Display online 802.1X user information. |
display dot1x connection [ ap ap-name [ radio radio-id ] | interface interface-type interface-number | slot slot-number | user-mac mac-address | user-name name-string ] |
|
Clear 802.1X statistics. |
reset dot1x statistics [ ap ap-name [ radio radio-id ] | interface interface-type interface-number ] |
Troubleshooting 802.1X
EAD assistant URL redirection failure
Symptom
Unauthenticated users are not redirected to the specified redirect URL after they enter external website addresses in their Web browsers.
Analysis
Redirection will not happen for one of the following reasons:
· The address is in the string format. The operating system of the host regards the string as a website name and tries to resolve the string. If the resolution fails, the operating system sends an ARP request, but the target address is not in the dotted decimal notation. The redirection feature does redirect this kind of ARP request.
· The address is within a free IP segment. No redirection will take place, even if no host is present with the address.
· The redirect URL is not in a free IP segment.
· No server is using the redirect URL, or the server with the URL does not provide Web services.
Solution
To resolve the issue:
1. Enter a dotted decimal IP address that is not in any free IP segments.
2. Verify that the access device and the server are configured correctly.
3. If the issue persists, contact H3C Support.
