18 802.1X Configuration

Contents
802.1X overview ··············································································1

802.1X architecture ···················································································································· 1
Controlled/uncontrolled port and port authorization status ··································································· 1
802.1X-related protocols·············································································································· 2
Packet formats···················································································································· 2
EAP over RADIUS ··············································································································· 3
802.1X authentication initiation ····································································································· 4
802.1X client as the initiator ··································································································· 4
Access device as the initiator ································································································· 4
802.1X authentication procedures ································································································· 5
Comparing EAP relay and EAP termination··············································································· 5
EAP relay ·························································································································· 6
EAP termination ·················································································································· 7
Configuring 802.1X ···········································································9
Access control methods ·············································································································· 9
802.1X VLAN manipulation ·········································································································· 9
Authorization VLAN ············································································································· 9
Guest VLAN ····················································································································· 12
Auth-Fail VLAN ················································································································· 13
Critical VLAN ···················································································································· 14
Critical voice VLAN ············································································································ 16
802.1X VSI manipulation ··········································································································· 16
802.1X support for VXLANs ································································································· 16
Authorization VSI ·············································································································· 17
Guest VSI ························································································································ 17
Auth-Fail VSI ···················································································································· 18
Critical VSI ······················································································································· 18
Using 802.1X authentication with other features ············································································· 19
ACL assignment················································································································ 19
EAD assistant ··················································································································· 20
Redirect URL assignment ··································································································· 20
802.1X configuration restrictions and guidelines ············································································· 20
Configuration prerequisites ········································································································ 21
802.1X configuration task list ······································································································ 21
Enabling 802.1X ······················································································································ 22
Enabling EAP relay or EAP termination ························································································ 23
Setting the port authorization state······························································································· 23
Specifying an access control method ··························································································· 24
Setting the maximum number of concurrent 802.1X users on a port ···················································· 24
Setting the maximum number of authentication request attempts ······················································· 24
Setting the 802.1X authentication timeout timers ············································································ 25
Configuring online user handshake ······························································································ 25
Configuration restrictions and guidelines ················································································ 26
Configuration procedure ····································································································· 26
Configuring 802.1X offline detection ····························································································· 26
Overview ························································································································· 26
Configuring 802.1X unauthenticated user aging ·············································································· 27
Overview ························································································································· 27
Configuring the authentication trigger feature ················································································· 28
Specifying a mandatory authentication domain on a port ·································································· 29
i
Setting the quiet timer ··············································································································· 29
Configuring 802.1X reauthentication ···························································································· 29
Overview ························································································································· 29
Configuring 802.1X periodic reauthentication··········································································· 30
Configuring 802.1X manual reauthentication ··········································································· 31
Enabling the keep-online feature ·························································································· 31
Configuring an 802.1X guest VLAN······························································································ 31
Configuration prerequisites ·································································································· 32
Enabling 802.1X guest VLAN assignment delay ············································································· 32
Configuring an 802.1X Auth-Fail VLAN ························································································· 33
Configuring an 802.1X critical VLAN ···························································································· 34
Enabling the 802.1X critical voice VLAN ······················································································· 35
Configuring an 802.1X guest VSI································································································· 36
Enabling 802.1X guest VSI assignment delay ················································································ 36
Overview ························································································································· 36
Configuring an 802.1X Auth-Fail VSI ···························································································· 37
Configuring an 802.1X critical VSI ······························································································· 38
Specifying supported domain name delimiters ················································································ 38
Enabling 802.1X user IP freezing ································································································ 39
Removing the VLAN tags of 802.1X protocol packets sent out of a port ··············································· 39
Overview ························································································································· 39
Setting the maximum number of 802.1X authentication attempts for MAC authenticated users ················· 40
Configuring 802.1X MAC address binding ····················································································· 41
Overview ························································································································· 41
Configuring the EAD assistant feature ·························································································· 41
Enabling logging for 802.1X users ······························································································· 42
Overview ························································································································· 42
Displaying and maintaining 802.1X ······························································································ 43
802.1X authentication configuration examples ················································································ 43
Basic 802.1X authentication configuration example ·································································· 43
802.1X guest VLAN and authorization VLAN configuration example ············································· 45
802.1X with ACL assignment configuration example ································································· 48
802.1X guest VSI and authorization VSI configuration example ··················································· 50
ii
802.1X with EAD assistant configuration example (with DHCP relay agent) ··································· 52
802.1X with EAD assistant configuration example (with DHCP server) ·········································· 55
Troubleshooting 802.1X ············································································································ 57
EAD assistant URL redirection failure ···················································································· 57
iii
802.1X overview
802.1X is a port-based network access control protocol initially proposed for securing WLANs. The
protocol has also been widely used on Ethernet networks for access control.
802.1X controls network access by authenticating the devices connected to 802.1X-enabled LAN
ports.
802.1X architecture
802.1X operates in the client/server model. As shown in Figure 1, 802.1X authentication includes the
following entities:
• Client (supplicant)—A user terminal seeking access to the LAN. The terminal must have
802.1X software to authenticate to the access device.
• Access device (authenticator)—Authenticates the client to control access to the LAN. In a
typical 802.1X environment, the access device uses an authentication server to perform
authentication.
• Authentication server—Provides authentication services for the access device. The
authentication server first authenticates 802.1X clients by using the data sent from the access
device. Then, the server returns the authentication results to the access device to make access
decisions. The authentication server is typically a RADIUS server. In a small LAN, you can use
the access device as the authentication server.
Figure 1 802.1X architecture
Controlled/uncontrolled port and port

authorization status
802.1X defines two logical ports for the network access port: controlled port and uncontrolled port.
Any packet arriving at the network access port is visible to both logical ports.
• Uncontrolled port—Is always open to receive and transmit authentication packets.
• Controlled port—Filters packets depending on the port state.
{ Authorized state—The controlled port is in authorized state when the client has passed
authentication. The port allows traffic to pass through.
{ Unauthorized state—The port is in unauthorized state when the client has failed
authentication. The port controls traffic by using one of the following methods:
− Performs bidirectional traffic control to deny traffic to and from the client.
− Performs unidirectional traffic control to deny traffic from the client. The H3C devices
support only unidirectional traffic control.
1
Figure 2 Authorization state of a controlled port
802.1X-related protocols
802.1X uses the Extensible Authentication Protocol (EAP) to transport authentication information for
the client, the access device, and the authentication server. EAP is an authentication framework that
uses the client/server model. The framework supports a variety of authentication methods, including
MD5-Challenge, EAP-Transport Layer Security (EAP-TLS), and Protected EAP (PEAP).
802.1X defines EAP over LAN (EAPOL) for passing EAP packets between the client and the access
device over a wired or wireless LAN. Between the access device and the authentication server,
802.1X delivers authentication information by using one of the following methods:
• Encapsulates EAP packets in RADIUS by using EAP over RADIUS (EAPOR), as described in
"EAP relay."
• Extracts authentication information from the EAP packets and encapsulates the information in
standard RADIUS packets, as described in "EAP termination."
Packet formats
EAP packet format
Figure 3 shows the EAP packet format.
Figure 3 EAP packet format
• Code—Type of the EAP packet. Options include Request (1), Response (2), Success (3), or
Failure (4).
• Identifier—Used for matching Responses with Requests.
• Length—Length (in bytes) of the EAP packet. The EAP packet length is the sum of the Code,
Identifier, Length, and Data fields.
2
• Data—Content of the EAP packet. This field appears only in a Request or Response EAP
packet. The Data field contains the request type (or the response type) and the type data. Type
1 (Identity) and type 4 (MD5-Challenge) are two examples for the type field.
EAPOL packet format
Figure 4 shows the EAPOL packet format.
Figure 4 EAPOL packet format
0 7 15
PAE Ethernet type 2

Protocol version Type 4
Length 6
Packet body
N
• PAE Ethernet type—Protocol type. It takes the value 0x888E for EAPOL.
• Protocol version—The EAPOL protocol version used by the EAPOL packet sender.
• Type—Type of the EAPOL packet. Table 1 lists the types of EAPOL packets supported by
implementation of 802.1X on the device.
Table 1 Types of EAPOL packets
Value Type Description

The client and the access device uses EAP-Packets to transport
0x00 EAP-Packet
authentication information.
The client sends an EAPOL-Start message to initiate 802.1X
0x01 EAPOL-Start
authentication to the access device.
The client sends an EAPOL-Logoff message to tell the access
0x02 EAPOL-Logoff
device that the client is logging off.
• Length—Data length in bytes, or length of the Packet body. If packet type is EAPOL-Start or
EAPOL-Logoff, this field is set to 0, and no Packet body field follows.
• Packet body—Content of the packet. When the EAPOL packet type is EAP-Packet, the Packet
body field contains an EAP packet.
EAP over RADIUS

RADIUS adds two attributes, EAP-Message and Message-Authenticator, for supporting EAP
authentication. For the RADIUS packet format, see "Configuring AAA."
EAP-Message
RADIUS encapsulates EAP packets in the EAP-Message attribute, as shown in Figure 5. The Type
field takes 79, and the Value field can be up to 253 bytes. If an EAP packet is longer than 253 bytes,
RADIUS encapsulates it in multiple EAP-Message attributes.
3
Figure 5 EAP-Message attribute format
Message-Authenticator
As shown in Figure 6, RADIUS includes the Message-Authenticator attribute in all packets that have
an EAP-Message attribute to check their integrity. The packet receiver drops the packet if the
calculated packet integrity checksum is different from the Message-Authenticator attribute value.
The Message-Authenticator prevents EAP authentication packets from being tampered with during
EAP authentication.
Figure 6 Message-Authenticator attribute format
802.1X authentication initiation

Both the 802.1X client and the access device can initiate 802.1X authentication.
802.1X client as the initiator

The client sends an EAPOL-Start packet to the access device to initiate 802.1X authentication. The
destination MAC address of the packet is the IEEE 802.1X specified multicast address
01-80-C2-00-00-03 or the broadcast MAC address. If any intermediate device between the client
and the authentication server does not support the multicast address, you must use an 802.1X client
that can send broadcast EAPOL-Start packets. For example, you can use the iNode 802.1X client.
Access device as the initiator

If the client cannot send EAPOL-Start packets, configure the access device to initiate authentication.
One example is the 802.1X client available with Windows XP.
The access device supports the following modes:
• Multicast trigger mode—The access device multicasts EAP-Request/Identity packets to
initiate 802.1X authentication at the identity request interval.
• Unicast trigger mode—Upon receiving a frame from an unknown MAC address, the access
device sends an EAP-Request/Identity packet out of the receiving port to the MAC address.
The device retransmits the packet if no response has been received within the identity request
timeout interval. This process continues until the maximum number of request attempts set by
using the dot1x retry command is reached.
The username request timeout timer sets both the identity request interval for the multicast trigger
and the identity request timeout interval for the unicast trigger.
4
802.1X authentication procedures
802.1X authentication has two methods: EAP relay and EAP termination. You choose either mode
depending on support of the RADIUS server for EAP packets and EAP authentication methods.
• EAP relay mode.
EAP relay is defined in IEEE 802.1X. In this mode, the network device uses EAPOR packets to
send authentication information to the RADIUS server, as shown in Figure 7.
Figure 7 EAP relay
In EAP relay mode, the client must use the same authentication method as the RADIUS server.
On the access device, you only need to use the dot1x authentication-method eap command
to enable EAP relay.
• EAP termination mode.
As shown in Figure 8, the access device performs the following operations in EAP termination
mode:
a. Terminates the EAP packets received from the client.
b. Encapsulates the client authentication information in standard RADIUS packets.
c. Uses PAP or CHAP to authenticate to the RADIUS server.
Figure 8 EAP termination
Comparing EAP relay and EAP termination

Packet exchange
Benefits Limitations
method
• Supports various EAP The RADIUS server must support the
authentication methods. EAP-Message and
EAP relay • The configuration and Message-Authenticator attributes, and
processing are simple on the the EAP authentication method used by
access device. the client.
• Supports only the following EAP
authentication methods:
Works with any RADIUS server { MD5-Challenge EAP
EAP termination that supports PAP or CHAP authentication.
authentication. { The username and password
EAP authentication initiated by
an iNode 802.1X client.
5
Packet exchange
Benefits Limitations
method
• The processing is complex on the
access device.
EAP relay
Figure 9 shows the basic 802.1X authentication procedure in EAP relay mode, assuming that
EAP-MD5 is used.
Figure 9 802.1X authentication procedure in EAP relay mode
Client Device Authentication server
EAPOL EAPOR
(1) EAPOL-Start
(2) EAP-Request/Identity
(3) EAP-Response/Identity (4) RADIUS Access-Request

(EAP-Response/Identity)
(5) RADIUS Access-Challenge
(EAP-Request/MD5-Challenge)
(6) EAP-Request/MD5-Challenge
(7) EAP-Response/MD5-Challenge (8) RADIUS Access-Request

(EAP-Response/MD5-Challenge)
(9) RADIUS Access-Accept
(EAP-Success)
(10) EAP-Success
Port authorized
(11) EAP-Request/Identity
(12) EAP-Response/Identity
...
(13) EAPOL-Logoff
Port unauthorized
(14) EAP-Failure
The following steps describe the 802.1X authentication procedure:

1. When a user launches the 802.1X client and enters a registered username and password, the
802.1X client sends an EAPOL-Start packet to the access device.
2. The access device responds with an EAP-Request/Identity packet to ask for the client
username.
3. In response to the EAP-Request/Identity packet, the client sends the username in an
EAP-Response/Identity packet to the access device.
4. The access device relays the EAP-Response/Identity packet in a RADIUS Access-Request
packet to the authentication server.
5. The authentication server uses the identity information in the RADIUS Access-Request to
search its user database. If a matching entry is found, the server uses a randomly generated
6
challenge (EAP-Request/MD5-Challenge) to encrypt the password in the entry. Then, the
server sends the challenge in a RADIUS Access-Challenge packet to the access device.
6. The access device transmits the EAP-Request/MD5-Challenge packet to the client.
7. The client uses the received challenge to encrypt the password, and sends the encrypted
password in an EAP-Response/MD5-Challenge packet to the access device.
8. The access device relays the EAP-Response/MD5-Challenge packet in a RADIUS
Access-Request packet to the authentication server.
9. The authentication server compares the received encrypted password with the encrypted
password it generated at step 5. If the two passwords are identical, the server considers the
client valid and sends a RADIUS Access-Accept packet to the access device.
10. Upon receiving the RADIUS Access-Accept packet, the access device performs the following
operations:
a. Sends an EAP-Success packet to the client.
b. Sets the controlled port in authorized state.
The client can access the network.
11. After the client comes online, the access device periodically sends handshake requests to
check whether the client is still online. By default, if two consecutive handshake attempts fail,
the device logs off the client.
12. Upon receiving a handshake request, the client returns a response. If the client fails to return a
response after a number of consecutive handshake attempts (two by default), the access
device logs off the client. This handshake mechanism enables timely release of the network
resources used by 802.1X users that have abnormally gone offline.
13. The client can also send an EAPOL-Logoff packet to ask the access device for a logoff.
14. In response to the EAPOL-Logoff packet, the access device changes the status of the
controlled port from authorized to unauthorized. Then, the access device sends an EAP-Failure
packet to the client.
EAP termination
Figure 10 shows the basic 802.1X authentication procedure in EAP termination mode, assuming that
CHAP authentication is used.
7
Figure 10 802.1X authentication procedure in EAP termination mode
In EAP termination mode, the access device rather than the authentication server generates an MD5
challenge for password encryption. The access device then sends the MD5 challenge together with
the username and encrypted password in a standard RADIUS packet to the RADIUS server.
8
Configuring 802.1X
This chapter describes how to configure 802.1X on an H3C device. You can also configure the port
security feature to perform 802.1X. Port security combines and extends 802.1X and MAC
authentication. It applies to a network, a WLAN, for example, that requires different authentication
methods for different users on a port. For more information about the port security feature, see
"Configuring port security."
Access control methods

H3C implements port-based access control as defined in the 802.1X protocol, and extends the
protocol to support MAC-based access control.
• Port-based access control—Once an 802.1X user passes authentication on a port, any
subsequent user can access the network through the port without authentication. When the
authenticated user logs off, all other users are logged off.
• MAC-based access control—Each user is separately authenticated on a port. When a user
logs off, no other online users are affected.
802.1X VLAN manipulation

Authorization VLAN
The authorization VLAN controls the access of an 802.1X user to authorized network resources. The
device supports authorization VLANs assigned locally or by a remote server.
IMPORTANT:
Only remote servers can assign tagged authorization VLANs.
Remote VLAN authorization

In remote VLAN authorization, you must configure the authorization VLAN for a user on the remote
server. After the user authenticates to the server, the server assigns authorization VLAN information
to the device. Then, the device assigns the user access port to the authorization VLAN as a tagged
or untagged member.
The device supports assignment of the following authorization VLAN information by the remote
server:
• VLAN ID.
• VLAN name, which must be the same as the VLAN description on the access device.
• A string of VLAN IDs and VLAN names.
In the string, some VLANs are represented by their IDs, and some VLANs are represented by
their names.
• VLAN group name.
For more information about VLAN groups, see Layer 2—LAN Switching Configuration Guide.
• VLAN ID with a suffix of t or u.
The t and u suffixes require the device to assign the access port to the VLAN as a tagged or
untagged member, respectively. For example, 2u indicates assigning the port to VLAN 2 as an
untagged member.
9
If a VLAN name or VLAN group name is assigned, the device converts the information into a VLAN
ID before VLAN assignment.
IMPORTANT:
For the VLAN represented by its VLAN name to be assigned successfully, you must make sure the
VLAN has been created on the device.
To assign VLAN IDs with suffixes, make sure the access port is a hybrid or trunk port that performs
port-based access control.
IMPORTANT:
To ensure a successful assignment, the authorization VLANs assigned by the remote server cannot
be any of the following types:
• Dynamically learned VLANs.
• Reserved VLANs.
• Super VLANs.
• Private VLANs.
If the server assigns a set of VLANs, the access device selects and assigns a VLAN as described
in Table 2.
Table 2 Authorization VLAN selection from a group of VLANs
VLAN information Authorization VLAN selection

If the 802.1X-enabled port performs MAC-based access control, the
device selects an authorization VLAN from the VLAN group for a user
according to the following rules:
• On a hybrid port with MAC-based VLAN enabled:
{ If the port does not have online users, the device selects the
VLAN with the lowest ID.
{ If the port has online users, the device selects the VLAN that has
the fewest online users. If two VLANs have the same number of
VLANs by IDs online 802.1X users, the device selects the VLAN with the lower
ID.
VLANs by names
• On an access, trunk, or MAC-based VLAN disabled hybrid port:
VLAN group name { If the port does not have online users, the device selects the
VLAN with the lowest ID.
{ If the port has online users, the device examines the VLAN
group for the VLAN of the online users. If the VLAN is found, the
VLAN is assigned to the user as the authorization VLAN. If the
VLAN is not found, VLAN authorization fails.
If the 802.1X-enabled port performs port-based access control, the
device selects the VLAN with the lowest ID from the VLAN group. All
subsequent 802.1X users are assigned to that VLAN.
1. The device selects the leftmost VLAN ID without a suffix, or the
leftmost VLAN ID suffixed by u as an untagged VLAN, whichever is
more leftmost.
2. The device assigns the untagged VLAN to the port as the PVID, and
it assigns the remaining as tagged VLANs. If no untagged VLAN is
VLAN IDs with suffixes assigned, the PVID of the port does not change. The port permits
traffic from these tagged and untagged VLANs to pass through.
For example, the authentication server sends the string 1u 2t 3 to the
access device for a user. The device assigns VLAN 1 as an untagged
VLAN and all remaining VLANs (including VLAN 3) as tagged VLANs.
VLAN 1 becomes the PVID.
10
Local VLAN authorization
To perform local VLAN authorization for a user, specify the VLAN ID in the authorization attribute list
of the local user account for that user. For each local user, you can specify only one authorization
VLAN ID. The port through which the user accesses the device is assigned to the VLAN as an
untagged member.
IMPORTANT:
Local VLAN authorization does not support assignment of tagged VLANs.
For more information about local user configuration, see "Configuring AAA."
Authorization VLAN manipulation for an 802.1X-enabled port
Table 3 describes how the access device handles VLANs (except for the VLANs specified with
suffixes) on an 802.1X-enabled port.
Table 3 VLAN manipulation
Port access control

VLAN manipulation
method
The device assigns the port to the first authenticated user's authorization
VLAN. All subsequent 802.1X users can access the VLAN without
authentication.
Port-based If the authorization VLAN has the untagged attribute, the device assigns the
port to the authorization VLAN as an untagged member and sets the VLAN
as the PVID. If the authorization VLAN has the tagged attribute, the device
assigns the port to the VLAN as a tagged member without changing the
PVID.
On a hybrid port with MAC-based VLAN enabled, the device maps the MAC
address of each user to its own authorization VLAN. The PVID of the port
does not change.
On an access, trunk, or MAC-based VLAN disabled hybrid port:
MAC-based • The device assigns the port to the first authenticated user's
authorization VLAN and sets the VLAN as the PVID if that authorization
VLAN has the untagged attribute.
• If the authorization VLAN has the tagged attribute, the device assigns
the port to the authorization VLAN without changing its PVID.
IMPORTANT:
• For users attached to an access port, make sure the authorization VLAN assigned by the server
has the untagged attribute. VLAN assignment will fail if the server issues a VLAN that has the
tagged attribute.
• When you assign VLANs to users attached to a trunk or MAC-based VLAN disabled hybrid port,
make sure there is only one untagged VLAN. If a different untagged VLAN is assigned to a
subsequent user, the user cannot pass authentication.
• As a best practice to enhance network security, do not use the port hybrid vlan command to
assign a hybrid port to an authorization VLAN as a tagged member.
Whether the authorization VLAN of an authenticated user takes effect on the 802.1X-enabled port
depends on the port link type and VLAN tagging mode.
• If the port is an access or trunk port, the authorization VLAN always takes effect.
• If the port is a hybrid port, the device compares the VLAN tagging mode assigned by the server
with the VLAN tagging mode configured on the port for the authorization VLAN.
{ If the VLAN tagging modes are the same one (tagged or untagged), the authorization VLAN
takes effect.
11
{ If the VLAN tagging modes are different, the configuration on the port takes effect instead of
the assigned information.
Authorization VLAN assignment does not affect the VLAN configuration on the 802.1X-enabled port.
After the user is logged off, the original VLAN configuration on the port is restored.
For an 802.1X authenticated user to access the network on a hybrid port when no authorization
VLANs are assigned to the user, perform one of the following tasks:
• If the port receives tagged authentication packets from the user in a VLAN, use the port hybrid
vlan command to configure the port as a tagged member in the VLAN.
• If the port receives untagged authentication packets from the user in a VLAN, use the port
hybrid vlan command to configure the port as an untagged member in the VLAN.
On a port with periodic online user reauthentication enabled, the MAC-based VLAN feature does not
take effect on a user that has been online since before this feature was enabled. The access device
creates a MAC-to-VLAN mapping for the user when the following requirements are met:
• The user passes reauthentication.
• The authorization VLAN for the user is changed.
For more information about VLAN configuration and MAC-based VLANs, see Layer 2—LAN
Switching Configuration Guide.
Guest VLAN
The 802.1X guest VLAN on a port accommodates users that have not performed 802.1X
authentication. Users in the guest VLAN can access a limited set of network resources, such as a
software server, to download antivirus software and system patches. Once a user in the guest VLAN
passes 802.1X authentication, it is removed from the guest VLAN and can access authorized
network resources.
The access device handles VLANs on an 802.1X-enabled port based on its 802.1X access control
method.
Port-based access control
Authentication status VLAN manipulation

The device assigns the port to the 802.1X guest VLAN. All 802.1X users on
A user accesses the this port can access only resources in the guest VLAN.
802.1X-enabled port when
the port is in auto state. The guest VLAN assignment varies by port link mode. For more information,
see Table 3 in "Authorization VLAN."
If an 802.1X Auth-Fail VLAN is available, the device assigns the port to the
Auth-Fail VLAN. All users on this port can access only resources in the
A user in the 802.1X guest Auth-Fail VLAN.
VLAN fails 802.1X
If no Auth-Fail VLAN is configured, the port is still in the 802.1X guest VLAN.
authentication.
All users on the port are in the guest VLAN.
For information about the 802.1X Auth-Fail VLAN, see "Auth-Fail VLAN."
The device removes the port from the 802.1X guest VLAN and assigns the
port to the authorization VLAN of the user.
If the authentication server does not assign an authorization VLAN, the initial
A user in the 802.1X guest PVID of the port applies. The user and all subsequent 802.1X users are
VLAN passes 802.1X assigned to the initial port VLAN.
authentication. After the user logs off, the port is assigned to the guest VLAN again.
NOTE:
The initial PVID of an 802.1X-enabled port refers to the PVID used by the
port before the port is assigned to any 802.1X VLANs.
12
IMPORTANT:
When the port receives a packet with a VLAN tag, the packet will be forwarded within the VLAN even
if the VLAN is not the guest VLAN.
MAC-based access control
Authentication
VLAN manipulation
status
A user accesses the port
The device creates a mapping between the MAC address of the user and the
and has not performed
802.1X guest VLAN. The user can access only resources in the guest VLAN.
802.1X authentication.
If an 802.1X Auth-Fail VLAN is available, the device remaps the MAC address
A user in the 802.1X of the user to the Auth-Fail VLAN. The user can access only resources in the
guest VLAN fails 802.1X Auth-Fail VLAN.
authentication. If no 802.1X Auth-Fail VLAN is configured, the user is removed from the guest
VLAN and added to the initial PVID.
A user in the 802.1X The device remaps the MAC address of the user to the authorization VLAN.
guest VLAN passes If the authentication server does not assign an authorization VLAN, the device
802.1X authentication. remaps the MAC address of the user to the initial PVID on the port.
For the 802.1X guest VLAN feature to take effect on a port that performs MAC-based access control,
make sure the following requirements are met:
• The port is a hybrid port.
• MAC-based VLAN is enabled on the port.
The network device assigns a hybrid port to an 802.1X guest VLAN as an untagged member.
Auth-Fail VLAN
The 802.1X Auth-Fail VLAN on a port accommodates users that have failed 802.1X authentication
because of the failure to comply with the organization security strategy. For example, the VLAN
accommodates users with wrong passwords entered. Users in the Auth-Fail VLAN can access a
limited set of network resources, such as a software server, to download antivirus software and
system patches.
method.

The device assigns the port to the Auth-Fail VLAN. All 802.1X users on this
A user accesses the port port can access only resources in the Auth-Fail VLAN.
and fails 802.1X
authentication. The Auth-Fail VLAN assignment varies by port link mode. For more
information, see Table 3 in "Authorization VLAN."
A user in the 802.1X
The port is still in the Auth-Fail VLAN, and all 802.1X users on this port are in
Auth-Fail VLAN fails 802.1X
this VLAN.
authentication.
A user in the 802.1X The device assigns the port to the authorization VLAN of the user, and it
Auth-Fail VLAN passes removes the port from the Auth-Fail VLAN.
802.1X authentication. If the authentication server does not assign an authorization VLAN, the initial
13
PVID of the port applies. The user and all subsequent 802.1X users are
assigned to the initial PVID.
After the user logs off, the port is assigned to the guest VLAN. If no guest
VLAN is configured, the port is assigned to the initial PVID of the port.

A user accesses the port
The device maps the MAC address of the user to the 802.1X Auth-Fail VLAN.
and fails 802.1X
The user can access only resources in the Auth-Fail VLAN.
authentication.
Auth-Fail VLAN fails 802.1X The user is still in the Auth-Fail VLAN.
authentication.
A user in the 802.1X The device remaps the MAC address of the user to the authorization VLAN.
Auth-Fail VLAN passes If the authentication server does not assign an authorization VLAN, the
802.1X authentication. device remaps the MAC address of the user to the initial PVID on the port.
For the 802.1X Auth-Fail VLAN feature to take effect on a port that performs MAC-based access
control, make sure the following requirements are met:
The access device assigns a hybrid port to an 802.1X Auth-Fail VLAN as an untagged member.
Critical VLAN
The 802.1X critical VLAN on a port accommodates 802.1X users that have failed authentication
because none of the RADIUS servers in their ISP domain are reachable. Users in the critical VLAN
can access a limited set of network resources depending on the configuration.
The critical VLAN feature takes effect when 802.1X authentication is performed only through
RADIUS servers. If an 802.1X user fails local authentication after RADIUS authentication, the user is
not assigned to the critical VLAN. For more information about the authentication methods, see
"Configuring AAA."
method.

The device assigns the port to the critical VLAN. The 802.1X
A user accesses the port and fails 802.1X user and all subsequent 802.1X users on this port can access
authentication because all the RADIUS only resources in the 802.1X critical VLAN.
servers are unreachable. The critical VLAN assignment varies by port link mode. For
more information, see Table 3 in "Authorization VLAN."
A user in the 802.1X critical VLAN fails
authentication because all the RADIUS The port is still in the critical VLAN.
servers are unreachable.
A user in the 802.1X critical VLAN fails If an 802.1X Auth-Fail VLAN has been configured, the port is
14
authentication for any reason other than assigned to the Auth-Fail VLAN. If no 802.1X Auth-Fail VLAN is
unreachable servers. configured, the port is assigned to the initial PVID of the port.
The device assigns the port to the authorization VLAN of the
user, and it removes the port from the 802.1X critical VLAN.
If the authentication server does not assign an authorization
A user in the 802.1X critical VLAN passes VLAN, the initial PVID of the port applies. The user and all
802.1X authentication. subsequent 802.1X users are assigned to this port VLAN.
After the user logs off, the port is assigned to the guest VLAN. If
no 802.1X guest VLAN is configured, the initial PVID of the port
is restored.
A user in the 802.1X guest VLAN fails
The device assigns the port to the 802.1X critical VLAN, and all
authentication because all the RADIUS
802.1X users on this port are in this VLAN.
A user in the 802.1X Auth-Fail VLAN fails The port is still in the 802.1X Auth-Fail VLAN. All 802.1X users
authentication because all the RADIUS on this port can access only resources in the 802.1X Auth-Fail
servers are unreachable. VLAN.
A user that has passed authentication
fails reauthentication because all the
The device assigns the port to the 802.1X critical VLAN.
RADIUS servers are unreachable, and
the user is logged out of the device.

A user accesses the port and fails 802.1X The device maps the MAC address of the user to the 802.1X
authentication because all the RADIUS critical VLAN. The user can access only resources in the
servers are unreachable. 802.1X critical VLAN.
A user in the 802.1X critical VLAN fails
authentication because all the RADIUS The user is still in the critical VLAN.
If an 802.1X Auth-Fail VLAN has been configured, the
device remaps the MAC address of the user to the Auth-Fail
A user in the 802.1X critical VLAN fails VLAN ID.
802.1X authentication for any reason rather
than unreachable servers. If no 802.1X Auth-Fail VLAN has been configured, the
device remaps the MAC address of the user to the initial
PVID.
The device remaps the MAC address of the user to the
authorization VLAN.
A user in the 802.1X critical VLAN passes
802.1X authentication. If the authentication server does not assign an authorization
VLAN to the user, the device remaps the MAC address of
the user to the initial PVID on the port.
A user in the 802.1X guest VLAN fails The device remaps the MAC address of the user to the
authentication because all the RADIUS 802.1X critical VLAN. The user can access only resources in
servers are unreachable. the 802.1X critical VLAN.
A user in the 802.1X Auth-Fail VLAN fails
authentication because all the RADIUS The user remains in the 802.1X Auth-Fail VLAN.
For the 802.1X critical VLAN feature to take effect on a port that performs MAC-based access control,
make sure the following requirements are met:
15
The network device assigns a hybrid port to an 802.1X critical VLAN as an untagged member.
When a reachable RADIUS server is detected, the device performs the following operations:
• If MAC-based access control is used, the device removes 802.1X users from the critical VLAN.
The port sends a unicast EAP-Request/Identity to these users to trigger authentication.
• If port-based access control is used, the device removes the port from the critical VLAN. The
port sends a multicast EAP-Request/Identity to all 802.1X users on the port to trigger
authentication.
Critical voice VLAN

The 802.1X critical voice VLAN on a port accommodates 802.1X voice users that have failed
authentication because none of the RADIUS servers in their ISP domain are reachable.
The critical voice VLAN feature takes effect when 802.1X authentication is performed only through
RADIUS servers. If an 802.1X voice user fails local authentication after RADIUS authentication, the
voice user is not assigned to the critical voice VLAN. For more information about the authentication
methods, see "Configuring AAA."
When a reachable RADIUS server is detected, the device performs the following operations:
• If port-based access control is used, the device removes the port from the critical voice VLAN.
The port sends a multicast EAP-Request/Identity packet to all 802.1X voice users on the port to
trigger authentication.
• If MAC-based access control is used, the device removes 802.1X voice users from the critical
voice VLAN. The port sends a unicast EAP-Request/Identity packet to each 802.1X voice user
that was assigned to the critical voice VLAN to trigger authentication.
802.1X VSI manipulation

IMPORTANT:
This feature is supported only on 802.1X-enabled ports that perform MAC-based access control.
802.1X support for VXLANs

The device can act as a VTEP in a VXLAN network. As shown in Figure 11, when VTEPs in a VXLAN
network act as NASs, users' VLANs cannot identify their service information. To resolve this issue,
you must configure the RADIUS server to assign VSIs to authenticated 802.1X users. The VTEPs
will map the users' traffic to the VXLANs that are associated with the users' respective authorization
VSIs. The mapping criteria include the user access VLAN, access port, and MAC address.
For information about VSIs and VXLANs, see VXLAN Configuration Guide.
16
Figure 11 VXLAN network diagram for 802.1X authentication
Authorization VSI
An authorization VSI is associated with a VXLAN that has network resources inaccessible to
unauthenticated users.
802.1X supports remote VSI authorization. When a user passes remote 802.1X authentication, the
remote server assigns the authorization VSI information of the user to the user's access port. Upon
receiving the authorization VSI information, the VTEP performs the following operations:
1. Dynamically creates an AC based on the user's access port, VLAN, and MAC address.
2. Maps the AC to the authorization VSI.
The user then can access resources in the VXLAN associated with the authorization VSI.
If the VTEP does not receive authorization VSI information for the user, the user cannot access
resources in any VXLAN after passing authentication.
For information about dynamic creation of ACs, see VXLAN configuration Guide.
Guest VSI
The 802.1X guest VSI on a port accommodates users that have not performed 802.1X
authentication. You can deploy a limited set of network resources in the VXLAN that is associated
with the guest VSI. For example, deploy a software server for users to download anti-virus software
and system patches. Once a user in the guest VSI passes 802.1X authentication, the user is
removed from the guest VSI and can access authorized network resources.
The following table shows how the VTEP handles VSIs on an 802.1X-enabled port that performs
MAC-based access control:
17
Authentication status VSI manipulation
A user accesses the port The VTEP maps the user's MAC address and access VLAN to the 802.1X guest
and has not performed VSI on the port. The user can access only resources in the VXLAN associated
802.1X authentication. with the guest VSI.
If an 802.1X Auth-Fail VSI is available on the port, the VTEP remaps the user's
A user in the 802.1X MAC address and access VLAN to the Auth-Fail VSI. The user can access only
guest VSI fails 802.1X resources in the VXLAN associated with the Auth-Fail VSI.
authentication. If no 802.1X Auth-Fail VSI is configured on the port, the user is removed from
the 802.1X guest VSI.
The VTEP removes the user from the 802.1X guest VSI and remaps the user's
guest VSI passes 802.1X
MAC address and access VLAN to the authorization VSI.
authentication.
Auth-Fail VSI
The 802.1X Auth-Fail VSI on a port accommodates users that have failed 802.1X authentication
because of the failure to comply with the organization security strategy. For example, the VSI
accommodates users with wrong passwords entered. Users in the Auth-Fail VSI can access a
limited set of network resources in the VXLAN associated with this VSI. You can deploy a software
server in the Auth-Fail VSI for users to download antivirus software and system patches.

A user accesses the port The VTEP maps the user's MAC address and access VLAN to the 802.1X
and fails 802.1X Auth-Fail VSI on the port. The user can access only resources in the VXLAN
authentication. associated with the Auth-Fail VSI.
Auth-Fail VSI fails 802.1X The user is still in the Auth-Fail VSI.
authentication.
The VTEP removes the user from the 802.1X Auth-Fail VSI and remaps the
Auth-Fail VSI passes
user's MAC address and access VLAN to the authorization VSI.
802.1X authentication.
Critical VSI
The 802.1X critical VSI on a port accommodates 802.1X users that have failed authentication
because none of the RADIUS servers in their ISP domain are reachable. Users in the critical VSI can
access a limited set of network resources in the VXLAN associated with this VSI.
The critical VSI feature takes effect when 802.1X authentication is performed only through RADIUS
servers. If an 802.1X user fails local authentication after RADIUS authentication, the user is not
assigned to the critical VSI. For more information about the authentication methods, see
"Configuring AAA."

A user accesses the port and fails 802.1X The VTEP maps the user's MAC address and access VLAN
authentication because all the RADIUS to the 802.1X critical VSI on the port. The user can access
servers are unreachable. only resources in the VXLAN associated with the critical VSI.
18
A user in the 802.1X critical VSI fails
authentication because all the RADIUS The user is still in the critical VSI.
If an 802.1X Auth-Fail VSI has been configured on the port,
A user in the 802.1X critical VSI fails 802.1X the VTEP remaps the user's MAC address and access
authentication for any reason other than VLAN to the Auth-Fail VSI.
unreachable servers. If no 802.1X Auth-Fail VSI has been configured on the port,
the VTEP logs off the user.
A user in the 802.1X critical VSI passes The VTEP remaps the user's MAC address and access
802.1X authentication. VLAN to the authorization VSI.
A user in the 802.1X guest VSI fails The VTEP maps the user's MAC address and access VLAN
authentication because all the RADIUS to the 802.1X critical VSI on the port. The user can access
servers are unreachable. only resources in the VXLAN associated with the critical VSI.
A user in the 802.1X Auth-Fail VSI fails
authentication because all the RADIUS The user remains in the 802.1X Auth-Fail VSI.
Using 802.1X authentication with other features

ACL assignment
You can specify an ACL for an 802.1X user on the authentication server to control the user's access
to network resources. After the user passes 802.1X authentication, the authentication server assigns
the ACL to the access port of the user. The ACL will filter traffic for this user by permitting or rejecting
matching traffic. The authentication server can be the local access device or a RADIUS server. In
either case, you must configure the ACL on the access device.
After receiving an ACL from the server, the device will check the following parameters defined in the
ACL rules:
• Source IP address.
• Destination IP address.
• Protocol type.
• Ethernet type.
• Source port.
• Destination port.
• DSCP priority.
For more information about these parameters, see ACL and QoS Command Reference.
To change the access control criteria for the user, you can use one of the following methods:
• Modify ACL rules on the access device.
• Specify another authorization ACL on the authentication server.
The supported authorization ACLs include the following types:
• Basic ACLs, which are numbered in the range of 2000 to 2999.
• Advanced ACLs, which are numbered in the range of 3000 to 3999.
• Layer 2 ACLs, which are numbered in the range of 4000 to 4999.
For an authorization ACL to take effect, make sure the ACL exists with rules and none of the rules
contains the counting, established, fragment, source-mac, or logging keyword.
19
For more information about ACLs, see ACL and QoS Configuration Guide.
EAD assistant
Endpoint Admission Defense (EAD) is an H3C integrated endpoint access control solution to
improve the threat defensive capability of a network. The solution enables the security client, security
policy server, access device, and third-party server to operate together. If a terminal device seeks to
access an EAD network, it must have an EAD client, which performs 802.1X authentication.
The EAD assistant feature enables the access device to redirect the HTTP or HTTPS requests of a
user to a redirect URL for downloading and installing an EAD client. This feature eliminates the
administrative task to deploy EAD clients.
EAD assistant is implemented by the following functionality:
• Free IP.
A free IP is a freely accessible network segment, which has a limited set of network resources
such as software and DHCP servers. To ensure security strategy compliance, an
unauthenticated user can access only this segment to perform operations. For example, the
user can download EAD client from a software server or obtain a dynamic IP address from a
DHCP server.
• Redirect URL.
If an unauthenticated 802.1X user is using a Web browser to access the network, EAD
assistant redirects the HTTP or HTTPS requests of the user to a specific URL. For example,
you can use this feature to redirect the user to the EAD client software download page.
The EAD assistant feature creates an ACL-based EAD rule automatically to open access to the
redirect URL for each redirected user.
EAD rules are implemented by using ACL resources. When the EAD rule timer expires or the user
passes authentication, the rule is removed. If users fail to download EAD client or fail to pass
authentication before the timer expires, they must reconnect to the network to access the free IP.
Redirect URL assignment

The device supports the URL attribute assigned by a RADIUS server when the 802.1X-enabled port
performs MAC-based access control and the port authorization state is auto. During authentication,
the HTTP or HTTPS requests of an 802.1X user are redirected to the Web interface specified by the
server-assigned URL attribute. After the user passes the Web authentication, the RADIUS server
records the MAC address of the user and uses a DM (Disconnect Message) to log off the user. When
the user initiates 802.1X authentication again, it will pass the authentication and come online
successfully.
This feature is mutually exclusive with the EAD assistant feature.
To redirect the HTTPS requests of 802.1X users, specify the HTTPS redirect listening port on the
device. For more information, see HTTP redirect in Layer 3—IP Services Configuration Guide.
802.1X configuration restrictions and guidelines

When you configure 802.1X, follow these restrictions and guidelines:
• VSI assignment is not supported on ports that perform port-based access control.
• To support the authorization VSI, 802.1X guest VSI, 802.1X Auth-Fail VSI, and 802.1X critical
VSI features on an 802.1X-enabled port, you must enable MAC-based traffic match mode for
dynamic ACs. To enable MAC-based traffic match mode for dynamic ACs, use the mac-based
ac command. For more information about this command, see VXLAN Command Reference.
20
• In a VXLAN network that is configured with 802.1X authentication, a MAC address cannot move
between local and remote sites. If a MAC address is authenticated on a site, users using the
same MAC address cannot access the network correctly in another site.
• If the authentication server assigns both authorization VSI and authorization VLAN information
to a user, the device uses only authorization VLAN information.
• On a port, the guest VLAN, Auth-Fail VLAN, and critical VLAN settings are mutually exclusive
with the guest VSI, Auth-Fail VSI, and critical VSI settings.
• For successful assignment of authorization VLANs or authorization VSIs, follow these
guidelines:
{ If a port is configured with the guest VLAN, Auth-Fail VLAN, or critical VLAN, configure the
authentication server to assign authorization VLANs to 802.1X users on the port.
{ If a port is configured with the guest VSI, Auth-Fail VSI, or critical VSI, configure the
authentication server to assign authorization VSIs to 802.1X users on the port.
• For the 802.1X guest VSI feature to work correctly, do not configure this feature together with
EAD assistant.
• Do not change the link type of a port when the 802.1X guest VLAN, Auth-Fail VLAN, or critical
VLAN on the port has users.
• 802.1X configuration is supported on Layer 2 Ethernet interfaces and Layer 2 aggregate
interfaces. In this chapter, the term "port" refers to a Layer 2 Ethernet interface or a Layer 2
aggregate interface.
• Do not delete a Layer 2 aggregate interface if the interface has online 802.1X users.
• After a Layer 2 Ethernet interface is added to an aggregation group, the 802.1X configuration
on the interface does not take effect. Before enabling 802.1X on a Layer 2 Ethernet interface,
make sure the interface is not added to a Layer 2 aggregation group.
Configuration prerequisites
Before you configure 802.1X, complete the following tasks:
• Configure an ISP domain and AAA scheme (local or RADIUS authentication) for 802.1X users.
• If RADIUS authentication is used, create user accounts on the RADIUS server.
• If local authentication is used, create local user accounts on the access device and set the
service type to lan-access.
802.1X configuration task list

Tasks at a glance
(Required.) Enabling 802.1X
(Required.) Enabling EAP relay or EAP termination
(Optional.) Setting the port authorization state
(Optional.) Specifying an access control method
(Optional.) Setting the maximum number of concurrent 802.1X users on a port
(Optional.) Setting the maximum number of authentication request attempts
(Optional.) Setting the 802.1X authentication timeout timers
(Optional.) Configuring online user handshake
(Optional.) Configuring 802.1X offline detection
21
Tasks at a glance
(Optional.) Configuring 802.1X unauthenticated user aging
(Optional.) Configuring the authentication trigger feature
(Optional.) Specifying a mandatory authentication domain on a port
(Optional.) Setting the quiet timer
(Optional.) Configuring 802.1X reauthentication
(Optional.) Configuring an 802.1X guest VLAN
(Optional.) Enabling 802.1X guest VLAN assignment delay
(Optional.) Configuring an 802.1X Auth-Fail VLAN
(Optional.) Configuring an 802.1X critical VLAN
(Optional.) Enabling the 802.1X critical voice VLAN
(Optional.) Configuring an 802.1X guest VSI
(Optional.) Enabling 802.1X guest VSI assignment delay
(Optional.) Configuring an 802.1X Auth-Fail VSI
(Optional.) Configuring an 802.1X critical VSI
(Optional.) Specifying supported domain name delimiters
(Optional.) Enabling 802.1X user IP freezing
(Optional.) Removing the VLAN tags of 802.1X protocol packets sent out of a port
(Optional.) Setting the maximum number of 802.1X authentication attempts for MAC authenticated users
(Optional.) Configuring 802.1X MAC address binding
(Optional.) Configuring the EAD assistant feature
(Optional.) Enabling logging for 802.1X users
Enabling 802.1X
When you enable 802.1X, follow these guidelines:
• For 802.1X to take effect on a port, you must enable it both globally and on the port.
• If the PVID is a voice VLAN, the 802.1X feature cannot take effect on the port. For more
information about voice VLANs, see Layer 2—LAN Switching Configuration Guide.
• Do not enable 802.1X on a port that is in a link aggregation or service loopback group.
To enable 802.1X:
Step Command Remarks

1. Enter system view. system-view N/A
2. Enable 802.1X globally. By default, 802.1X is disabled

dot1x
globally.
3. Enter Ethernet interface interface interface-type
view. N/A
interface-number
4. Enable 802.1X on a port. By default, 802.1X is disabled

dot1x
on a port.
22
Enabling EAP relay or EAP termination
When configuring EAP relay or EAP termination, consider the following factors:
• Support of the RADIUS server for EAP packets.
• Authentication methods supported by the 802.1X client and the RADIUS server.
You can use both EAP termination and EAP relay in any of the following situations:
• The client is using only MD5-Challenge EAP authentication. If EAP termination is used, you
must enable CHAP authentication on the access device.
• The client is an iNode 802.1X client and initiates only the username and password EAP
authentication. If EAP termination is used, you can enable either PAP or CHAP authentication
on the access device. However, if the password is required to be transmitted in cipher text, you
must use CHAP authentication on the access device.
To use EAP-TLS, PEAP, or any other EAP authentication methods, you must use EAP relay. When
you make your decision, see "Comparing EAP relay and EAP termination" for help.
For more information about EAP relay and EAP termination, see "802.1X authentication
procedures."
To configure EAP relay or EAP termination:

1. Enter system
view. system-view N/A
By default, the access device performs EAP

termination and uses CHAP to communicate with
2. Configure EAP dot1x the RADIUS server.
relay or EAP authentication-method
termination. Specify the eap keyword to enable EAP relay.
{ chap | eap | pap }
Specify the chap or pap keyword to enable
CHAP-enabled or PAP-enabled EAP termination.
NOTE:
If EAP relay mode is used, the user-name-format command configured in RADIUS scheme view
does not take effect. The access device sends the authentication data from the client to the server
without any modification.
Setting the port authorization state

The port authorization state determines whether the client is granted access to the network. You can
control the authorization state of a port by using the dot1x port-control command and the following
keywords:
• authorized-force—Places the port in the authorized state, enabling users on the port to access
the network without authentication.
• unauthorized-force—Places the port in the unauthorized state, denying any access requests
from users on the port.
• auto—Places the port initially in unauthorized state to allow only EAPOL packets to pass. After
a user passes authentication, sets the port in the authorized state to allow access to the
network. You can use this option in most scenarios.
To set the authorization state of a port:
23
view. N/A
interface-number
3. Set the port authorization dot1x port-control

By default, the auto state
state. { authorized-force | auto |
applies.
unauthorized-force }
Specifying an access control method

view. N/A
interface-number
By default, MAC-based access
control applies.
To use both 802.1X and portal
3. Specify an access control dot1x port-method { macbased authentication on a port, you must
method. | portbased } specify MAC-based access
control. For information about
portal authentication, see
"Configuring portal
authentication."
Setting the maximum number of concurrent

802.1X users on a port
Perform this task to prevent the system resources from being overused.
To set the maximum number of concurrent 802.1X users on a port:

view. N/A
interface-number
3. Set the maximum number of
concurrent 802.1X users on The default setting is
dot1x max-user max-number
a port. 4294967295.
Setting the maximum number of authentication

request attempts
The access device retransmits an authentication request if it does not receive any responses to the
request from the client within a period of time. To set the time, use the dot1x timer tx-period
tx-period-value command or the dot1x timer supp-timeout supp-timeout-value command. The
24
access device stops retransmitting the request if it has made the maximum number of request
transmission attempts but still receives no response.
To set the maximum number of authentication request attempts:

2. Set the maximum number of attempts The default setting is
for sending an authentication request. dot1x retry retries
2.
Setting the 802.1X authentication timeout timers

The network device uses the following 802.1X authentication timeout timers:
• Client timeout timer—Starts when the access device sends an EAP-Request/MD5-Challenge
packet to a client. If no response is received when this timer expires, the access device
retransmits the request to the client.
• Server timeout timer—Starts when the access device sends a RADIUS Access-Request
packet to the authentication server. If no response is received when this timer expires, the
access device retransmits the request to the server.
In most cases, the default settings are sufficient. You can edit the timers, depending on the network
conditions.
• In a low-speed network, increase the client timeout timer.
• In a network with authentication servers of different performance, adjust the server timeout
timer.
To set the 802.1X authentication timeout timers:

2. Set the client timeout dot1x timer supp-timeout
timer. The default is 30 seconds.
supp-timeout-value
3. Set the server dot1x timer server-timeout
timeout timer. The default is 100 seconds.
server-timeout-value
Configuring online user handshake

The online user handshake feature checks the connectivity status of online 802.1X users. The
access device sends handshake requests (EAP-Request/Identity) to online users at the interval
specified by the dot1x timer handshake-period command. If the device does not receive any
EAP-Response/Identity packets from an online user after it has made the maximum handshake
attempts, the device sets the user to offline state. To set the maximum handshake attempts, use the
dot1x retry command.
To use the online user handshake feature, make sure the 802.1X client can exchange handshake
packets with the device.
Typically, the device does not reply to 802.1X clients' EAP-Response/Identity packets with
EAP-Success packets. Some 802.1X clients will go offline if they do not receive the EAP-Success
packets for handshake. To avoid this issue, enable the online user handshake reply feature.
If iNode clients are deployed, you can also enable the online user handshake security feature to
check authentication information in the handshake packets from clients. This feature can prevent
25
802.1X users that use illegal client software from bypassing iNode security check, such as dual
network interface cards (NICs) detection. If a user fails the handshake security checking, the device
sets the user to the offline state.
Configuration restrictions and guidelines

When you configure online user handshake, follow these restrictions and guidelines:
• To use the online user handshake security feature, make sure the online user handshake
feature is enabled.
• The online user handshake security feature takes effect only on the network where the iNode
client and IMC server are used.
• If the network has 802.1X clients that cannot exchange handshake packets with the access
device, disable the online user handshake feature. This operation prevents the 802.1X
connections from being incorrectly torn down.
• Enable the online user handshake reply feature only if 802.1X clients will go offline without
receiving EAP-Success packets from the device.
Configuration procedure
To configure the online user handshake feature:

2. (Optional.) Set the dot1x timer handshake-period
handshake timer. The default is 15 seconds.
handshake-period-value
view. N/A
interface-number
4. Enable the online user
handshake feature. dot1x handshake By default, the feature is enabled.
5. (Optional.) Enable the online

user handshake security dot1x handshake secure By default, the feature is disabled.
feature.
By default, the device does not
6. (Optional.) Enable the reply to 802.1X clients'
802.1X online user dot1x handshake reply enable EAP-Response/Identity packets
handshake reply feature. during the online handshake
process.
Configuring 802.1X offline detection

Overview
The 802.1X offline detection feature monitors the online status of 802.1X users. This feature uses an
offline detect timer to set the interval that the device waits for traffic from a user before the device
regards the user as idle. If the device has not received traffic from a user before the timer expires, the
device logs off that user and requests the accounting server to stop accounting for the user.
The 802.1X offline detection feature does not detect 802.1X protocol packets.
26
The 802.1X offline detection feature takes effect only on a port that performs MAC-based access
control. If you change the port access mode to port-based, the 802.1X offline detection feature
cannot take effect.
For this feature to operate as expected, do not set the offline detect timer to the same value as either
of the following timers:
• Handshake timer (set by using the dot1x timer handshake-period command).
• Periodic reauthentication timer (set by using the dot1x timer reauth-period command).
To configure 802.1X offline detection:

2. (Optional.) Set the 802.1X dot1x timer offline-detect By default, the 802.1X offline
offline detect timer. offline-detect-value detect timer is 300 seconds.
3. Enter interface view. interface interface-type

N/A
interface-number
4. Enable 802.1X offline By default, 802.1X offline
detection. dot1x offline-detect enable
detection is disabled.
Configuring 802.1X unauthenticated user aging

Overview
802.1X unauthenticated user aging applies to users added to an 802.1X guest, critical, or Auth-Fail
VLAN or VSI because they have not been authenticated or have failed authentication.
When a user in one of those VLANs or VSIs ages out, the device removes the user from the VLAN or
VSI and deletes the MAC address entry for the user from the access port.
For users in one of those VLANs or VSIs on one port to be authenticated successfully and come
online on another port, enable this feature. In any other scenarios, disable this feature as a best
practice.
The 802.1X user aging mechanism on a port depends on its access control mode.
• If the port uses port-based access control, a user aging timer starts when the port is assigned to
the critical or Auth-Fail VLAN or VSI. When the aging timer expires, the port is removed from the
VLAN or VSI and all MAC address entries for users in the VLAN or VSI are also removed.
• If the port uses MAC-based access control, a user aging timer starts for each 802.1X user when
they are assigned to the Auth-Fail, critical, or guest VLAN or VSI. When the aging timer for a
user expires, the device removes that user from the VLAN or VSI.

As a best practice, disable 802.1X unauthenticated user aging on one port unless you want to have
unauthenticated users on that port to be authenticated and come online on another port.
27
To configure 802.1X unauthenticated user aging:

dot1x timer user-aging
By default, the user aging timers
2. Set the user aging timer for a { auth-fail-vlan | auth-fail-vsi |
for all applicable types of 802.1X
type of 802.1X VLAN or VSI. critical-vlan | critical-vsi |
VLANs and VSIs are 1000
guest-vlan | guest-vsi }
seconds.
aging-time-value

N/A
interface-number
4. Enable 802.1X By default, 802.1X

dot1x unauthenticated-user
unauthenticated user aging. unauthenticated user aging is
aging enable
enabled.
Configuring the authentication trigger feature

The authentication trigger feature enables the access device to initiate 802.1X authentication when
802.1X clients cannot initiate authentication.
This feature provides the multicast trigger and unicast trigger (see 802.1X authentication initiation in
"802.1X overview").

When you configure the authentication trigger feature, follow these restrictions and guidelines:
• Enable the multicast trigger on a port when the clients attached to the port cannot send
EAPOL-Start packets to initiate 802.1X authentication.
• Enable the unicast trigger on a port if only a few 802.1X clients are attached to the port and
these clients cannot initiate authentication.
• To avoid duplicate authentication packets, do not enable both triggers on a port.
To configure the authentication trigger feature on a port:

2. (Optional.) Set the username dot1x timer tx-period
request timeout timer. The default is 30 seconds.
tx-period-value
view. N/A
interface-number
4. Enable an authentication By default, the multicast trigger is

dot1x { multicast-trigger |
trigger. enabled, and the unicast trigger is
unicast-trigger }
disabled.
28
Specifying a mandatory authentication domain on
a port
You can place all 802.1X users in a mandatory authentication domain for authentication,
authorization, and accounting on a port. No user can use an account in any other domain to access
the network through the port. The implementation of a mandatory authentication domain enhances
the flexibility of 802.1X access control deployment.
To specify a mandatory authentication domain for a port:

view. N/A
interface-number
3. Specify a mandatory 802.1X By default, no mandatory 802.1X
authentication domain on the dot1x mandatory-domain
authentication domain is
port. domain-name
specified.
Setting the quiet timer

The quiet timer enables the access device to wait a period of time before it can process any
authentication request from a client that has failed an 802.1X authentication.
You can edit the quiet timer, depending on the network conditions.
• In a vulnerable network, set the quiet timer to a high value.
• In a high-performance network with quick authentication response, set the quiet timer to a low
value.
To set the quiet timer:

2. Enable the quiet timer. dot1x quiet-period By default, the timer is disabled.
3. (Optional.) Set the quiet dot1x timer quiet-period
timer. The default is 60 seconds.
quiet-period-value
Configuring 802.1X reauthentication

Overview
802.1X reauthentication tracks the connection status of online users and updates the authorization
attributes assigned by the server. The attributes include the ACL and VLAN.
The following methods are available for 802.1X reauthentication:
• Manual reauthentication—Allows you to manually reauthenticate all online 802.1X users on a
port.
• Periodic reauthentication—Reauthenticates online users at a user-configurable
reauthentication interval.
29
By default, the device logs off online 802.1X users if no server is reachable for 802.1X
reauthentication. The keep-online feature keeps authenticated 802.1X users online when no server
is reachable for 802.1X reauthentication, either manually or periodically.

When you configure 802.1X reauthentication, follow these restrictions and guidelines:
• The server-assigned session timeout timer (Session-Timeout attribute) and termination action
(Termination-Action attribute) together can affect periodic reauthentication. To display the
server-assigned Session-Timeout and Termination-Action attributes, use the display dot1x
connection command (see Security Command Reference).
{ If the termination action is Default (logoff), periodic reauthentication on the device takes
effect only when the periodic reauthentication timer is shorter than the session timeout
timer.
{ If the termination action is Radius-request, the periodic reauthentication configuration on
the device does not take effect. The device reauthenticates the online 802.1X users after
the session timeout timer expires.
Support for the assignment of Session-Timeout and Termination-Action attributes depends on
the server model.
• You can set the periodic reauthentication timer either in system view or in interface view by
using the dot1x timer reauth-period command. A change to the periodic reauthentication
timer applies to online users only after the old timer expires.
The device selects a periodic reauthentication timer for 802.1X reauthentication in the following
order:
a. Server-assigned reauthentication timer.
b. Port-specific reauthentication timer.
c. Global reauthentication timer.
d. Default reauthentication timer.
• The VLANs assigned to an online user before and after reauthentication can be the same or
different.
• Any modification to the mandatory authentication domain or EAP message handling method
setting does not affect the reauthentication of online 802.1X users. The modified setting takes
effect only on 802.1X users that come online after the modification.
Configuring 802.1X periodic reauthentication

2. (Optional.) Set the global
periodic reauthentication dot1x timer reauth-period
The default is 3600 seconds.
timer. reauth-period-value

view. N/A
interface-number
4. Enable 802.1X periodic
reauthentication. dot1x re-authenticate By default, the feature is disabled.
By default, no periodic
5. (Optional.) Set the periodic reauthentication timer is set on a
reauthentication timer on the dot1x timer reauth-period
port. The port uses the global
port. reauth-period-value
802.1X periodic reauthentication
timer.
30
Configuring 802.1X manual reauthentication
view. N/A
interface-number
3. Manually reauthenticate all The device immediately

online 802.1X users on the reauthenticates all online 802.1X
dot1x re-authenticate manual
port. users on the port after you
execute this command.
Enabling the keep-online feature

view. N/A
interface-number
By default, this feature is disabled.
The device logs off online 802.1X
users if no authentication server is
reachable for 802.1X
reauthentication, either manually
or periodically.
3. Enable the keep-online dot1x re-authenticate
Use the keep-online feature
feature for 802.1X users. server-unreachable
according to the actual network
keep-online
condition.
In a fast-recovery network, you
can use the keep-online feature to
prevent 802.1X users from
coming online and going offline
frequently.
Configuring an 802.1X guest VLAN

When you configure an 802.1X guest VLAN, follow these restrictions and guidelines:
• You can configure only one 802.1X guest VLAN on a port. The 802.1X guest VLANs on different
ports can be different.
• Assign different IDs to the voice VLAN, the port VLAN, and the 802.1X guest VLAN on a port.
The assignment makes sure the port can correctly process incoming VLAN-tagged traffic.
• When you configure multiple security features on a port, follow the guidelines in Table 4.
Table 4 Relationships of the 802.1X guest VLAN and other security features
Feature Relationship description Reference

The MAC-based VLAN has higher priority than See Layer 2—LAN
MAC-based VLAN the 802.1X guest VLAN on a port that performs Switching Configuration
port-based access control. Guide.
31
See Layer 2—LAN
You cannot specify a VLAN as both a super
Super VLAN Switching Configuration
VLAN and an 802.1X guest VLAN.
Guide.
802.1X Auth-Fail VLAN
on a port that performs The 802.1X Auth-Fail VLAN has higher priority See "802.1X VLAN
MAC-based access than the 802.1X guest VLAN. manipulation."
control
The 802.1X guest VLAN feature has higher
Port intrusion protection priority than the block MAC action.
actions on a port that See "Configuring port
performs MAC-based The 802.1X guest VLAN feature has lower security."
access control priority than the shutdown port action of the
port intrusion protection feature.
Before you configure an 802.1X guest VLAN, complete the following tasks:
• Create the VLAN to be specified as the 802.1X guest VLAN.
• If the 802.1X-enabled port performs MAC-based access control, perform the following
operations for the port:
{ Configure the port as a hybrid port.
{ Enable MAC-based VLAN on the port. For more information about MAC-based VLANs, see
Layer 2—LAN Switching Configuration Guide.
{ Assign the port to the 802.1X guest VLAN as an untagged member.
To configure an 802.1X guest VLAN:

view. N/A
interface-number
3. Configure the 802.1X guest By default, no 802.1X guest VLAN
VLAN on the port. dot1x guest-vlan guest-vlan-id
exists.
Enabling 802.1X guest VLAN assignment delay

This feature delays assigning an 802.1X-enabled port to the 802.1X guest VLAN when 802.1X
authentication is triggered on the port.
This feature applies only to situations where 802.1X authentication is triggered by EAPOL-Start
packets from 802.1X clients or packets from unknown MAC addresses.
To use this feature, the 802.1X-enabled port must perform MAC-based access control.
When 802.1X authentication is triggered on a port, the device performs the following operations:
1. Sends a unicast EAP-Request/Identity packet to the MAC address that triggers the
authentication.
32
2. Retransmits the packet if no response is received within the username request timeout interval
set by using the dot1x timer tx-period command.
3. Assigns the port the 802.1X guest VLAN after the maximum number of request attempts set by
To enable 802.1X guest VLAN assignment delay on a port:

2. Enter Layer 2 Ethernet interface interface-type
interface view. N/A
interface-number
3. Enable 802.1X guest
VLAN assignment delay dot1x guest-vlan-delay By default, 802.1X guest VLAN
on the port. { eapol | new-mac } assignment delay is disabled on a port.
Configuring an 802.1X Auth-Fail VLAN

When you configure an 802.1X Auth-Fail VLAN, follow these restrictions and guidelines:
• Assign different IDs to the voice VLAN, the port VLAN, and the 802.1X Auth-Fail VLAN on a port.
The assignment makes sure the port can correctly process VLAN-tagged incoming traffic.
• You can configure only one 802.1X Auth-Fail VLAN on a port. The 802.1X Auth-Fail VLANs on
different ports can be different.
• When you configure multiple security features on a port, follow the guidelines in Table 5.
Table 5 Relationships of the 802.1X Auth-Fail VLAN with other features

You cannot specify a VLAN as
See Layer 2—LAN Switching
Super VLAN both a super VLAN and an
Configuration Guide.
802.1X Auth-Fail VLAN.
MAC authentication guest VLAN
The 802.1X Auth-Fail VLAN has See "Configuring MAC
on a port that performs
a high priority. authentication."
The 802.1X Auth-Fail VLAN
feature has higher priority than
Port intrusion protection actions the block MAC action.
on a port that performs The 802.1X Auth-Fail VLAN See "Configuring port security."
MAC-based access control feature has lower priority than
the shutdown port action of the
port intrusion protection feature.
Before you configure an 802.1X Auth-Fail VLAN, complete the following tasks:
• Create the VLAN to be specified as the 802.1X Auth-Fail VLAN.
33
{ Assign the port to the Auth-Fail VLAN as an untagged member.
To configure an 802.1X Auth-Fail VLAN:

view. N/A
interface-number
3. Configure the 802.1X dot1x auth-fail vlan By default, no 802.1X Auth-Fail
Auth-Fail VLAN on the port. authfail-vlan-id VLAN exists.
Configuring an 802.1X critical VLAN

Typically, when a client user is assigned to the 802.1X critical VLAN on a port, the device sends an
EAP-Failure packet to the client. Some 802.1X clients, such as Windows built-in 802.1X clients,
cannot respond to the EAP-Request/Identity packets of the device if they have received an
EAP-Failure packet. As a result, reauthentication fails for these clients when an authentication server
is reachable.
To resolve this issue, configure the device to send EAP-Success packets instead of EAP-Failure
packets for 802.1X user assignment to the 802.1X critical VLAN. This configuration ensures that all
802.1X clients can perform reauthentication.

When you configure an 802.1X critical VLAN, follow these restrictions and guidelines:
• Assign different IDs to the voice VLAN, the PVID, and the 802.1X critical VLAN on a port. The
assignment makes sure the port can correctly process VLAN-tagged incoming traffic.
• You can configure only one 802.1X critical VLAN on a port. The 802.1X critical VLANs on
different ports can be different.
• You cannot specify a VLAN as both a super VLAN and an 802.1X critical VLAN. For information
about super VLANs, see Layer 2—LAN Switching Configuration Guide.
Before you configure an 802.1X critical VLAN, complete the following tasks:
• Create the VLAN to be specified as a critical VLAN.
{ Assign the port to the 802.1X critical VLAN as an untagged member.
34
To configure an 802.1X critical VLAN:

view. N/A
interface-number
3. Configure the 802.1X critical By default, no 802.1X critical
VLAN on the port. dot1x critical vlan critical-vlan-id
VLAN exists.
4. (Optional.) Send an
EAP-Success packet to a By default, the device sends an
client when the 802.1X client EAP-Failure packet to a client
user is assigned to the dot1x critical eapol when the 802.1X client user is
802.1X critical VLAN on the assigned to the 802.1X critical
port. VLAN on the port.
Enabling the 802.1X critical voice VLAN

The feature does not take effect if the voice user has been in the 802.1X Auth-Fail VLAN.
Before you enable the 802.1X critical voice VLAN on a port, complete the following tasks:
• Enable LLDP both globally and on the port.
The device uses LLDP to identify voice users. For information about LLDP, see Layer 2—LAN
• Enable voice VLAN on the port.
For information about voice VLANs, see Layer 2—LAN Switching Configuration Guide.
To enable the 802.1X critical voice VLAN feature on a port:

view. N/A
interface-number
3. Enable the 802.1X critical By default, the 802.1X critical
voice VLAN feature on a dot1x critical-voice-vlan voice VLAN feature is disabled on
port. a port.
35
Configuring an 802.1X guest VSI
You can configure only one 802.1X guest VSI on a port. The 802.1X guest VSIs on different ports can
be different.
Only ports that perform MAC-based access control support the 802.1X guest VSI.
Before you configure the 802.1X guest VSI on an 802.1X-enabled port, complete the following tasks:
• Enable L2VPN.
• Create the VSI to be specified as the 802.1X guest VSI, and create a VXLAN for the VSI.
• Enable MAC-based traffic match mode for dynamic ACs.
For more information, see VXLAN Configuration Guide.
To configure the 802.1X guest VSI on a port:


N/A
interface-number
3. Configure the 802.1X guest By default, no 802.1X guest VSI
VSI on the port. dot1x guest-vsi guest-vsi-name
exists.
Enabling 802.1X guest VSI assignment delay

Overview
This feature delays assigning an 802.1X-enabled port to the 802.1X guest VSI when 802.1X
authentication is triggered on the port.
This feature applies only to situations where 802.1X authentication is triggered by EAPOL-Start
packets from 802.1X clients or packets from unknown MAC addresses.
To use this feature, the 802.1X-enabled port must perform MAC-based access control.
When 802.1X authentication is triggered on a port, the device performs the following operations:
1. Sends a unicast EAP-Request/Identity packet to the MAC address that triggers the
authentication.
2. Retransmits the packet if no response is received within the username request timeout interval
set by using the dot1x timer tx-period command.
3. Assigns the port to the 802.1X guest VSI after the maximum number of request attempts set by
This feature can work with the parallel processing of MAC authentication and 802.1X authentication
feature when a port performs a combination of 802.1X and MAC authentication. The collaboration
36
facilitates the port to perform MAC authentication before it is assigned to the 802.1X guest VSI. For
information about the parallel processing of MAC authentication and 802.1X authentication feature,
see "Configuring MAC authentication."
To enable 802.1X guest VSI assignment delay on a port:


N/A
interface-number
3. Enable 802.1X guest VSI
assignment delay on the dot1x guest-vsi-delay { eapol By default, 802.1X guest VSI
port. | new-mac } assignment delay is disabled on a port.
Configuring an 802.1X Auth-Fail VSI

You can configure only one 802.1X Auth-Fail VSI on a port. The 802.1X Auth-Fail VSIs on different
ports can be different.
Only ports that perform MAC-based access control support the 802.1X Auth-Fail VSI.
Before you configure the 802.1X Auth-Fail VSI on an 802.1X-enabled port, complete the following
tasks:
• Enable L2VPN.
• Create the VSI to be specified as the 802.1X Auth-Fail VSI, and create a VXLAN for the VSI.
To configure the 802.1X Auth-Fail VSI on a port:


N/A
interface-number
3. Configure the 802.1X dot1x auth-fail vsi By default, no 802.1X Auth-Fail
Auth-Fail VSI on the port. authfail-vsi-name VSI exists.
37
Configuring an 802.1X critical VSI
You can configure only one 802.1X critical VSI on a port. The 802.1X critical VSIs on different ports
can be different.
Only ports that perform MAC-based access control support the 802.1X critical VSI.
Before you configure the 802.1X critical VSI on an 802.1X-enabled port, complete the following
tasks:
• Enable L2VPN.
• Create the VSI to be specified as the 802.1X critical VSI, and create a VXLAN for the VSI.
To configure the 802.1X critical VSI on a port:


N/A
interface-number
3. Configure the 802.1X critical dot1x critical vsi By default, no 802.1X critical VSI
VSI on the port. critical-vsi-name exists.
Specifying supported domain name delimiters

By default, the access device supports the at sign (@) as the delimiter. You can also configure the
access device to accommodate 802.1X users that use other domain name delimiters. The
configurable delimiters include the at sign (@), backslash (\), dot (.), and forward slash (/).
Usernames that include domain names can use the format of username@domain-name,
domain-name\username, username.domain-name, or username/domain-name.
If an 802.1X username string contains multiple configured delimiters, the rightmost delimiter is the
domain name delimiter. For example, if you configure the backslash (\), dot (.), and forward slash (/)
as delimiters, the domain name delimiter for the username string 121.123/22\@abc is the backslash
(\). The username is @abc and the domain name is 121.123/22.
If a username string contains none of the delimiters, the access device authenticates the user in the
mandatory or default ISP domain.
To specify a set of domain name delimiters:

2. Specify a set of domain dot1x domain-delimiter string By default, only the at sign (@)
38
name delimiters for 802.1X delimiter is supported.
users.
NOTE:
If you configure the access device to send usernames with domain names to the RADIUS server,
make sure the domain delimiter can be recognized by the RADIUS server. For username format
configuration, see the user-name-format command in Security Command Reference.
Enabling 802.1X user IP freezing

This feature works with the IP source guard feature. 802.1X-based IP source guard requires that
802.1X clients support sending user IP addresses to the access device. The device uses information
such as user MAC addresses and IP addresses obtained through 802.1X to generate IPSG bindings
to filter out IPv4 packets from unauthenticated 802.1X users. For information about IP source guard,
see "Configuring IP source guard."
This feature prevents any authenticated 802.1X users on a port from changing their IP addresses.
After you enable this feature, the port does not update the IP addresses in dynamic IPSG bindings
for 802.1X users. If an 802.1X user uses an IP address different from the IP address in its IPSG
binding entry, the port denies the user access.
To enable 802.1X user IP freezing:

interface view. N/A
interface-number
3. Enable 802.1X user IP By default, 802.1X user IP freezing is
freezing. dot1x user-ip freeze
disabled.
Removing the VLAN tags of 802.1X protocol

packets sent out of a port
Overview
This feature operates on a hybrid port to have it send 802.1X protocol packets with their VLAN tags
removed, regardless of whether the port is a tagged or untagged member of a VLAN.
Use this feature if the 802.1X-enabled hybrid port is a tagged member of its PVID and the attached
802.1X clients cannot recognize VLAN-tagged 802.1X protocol packets.

This feature removes the VLAN tags of all 802.1X protocol packets sent out of the port to 802.1X
clients. Do not use this feature if VLAN-aware 802.1X clients are attached to the port.
39
Set the link type of the 802.1X-enabled port to hybrid. For more information, see VLAN configuration
in Layer 2 LAN Switching Configuration Guide.
To remove the VLAN tags of all 802.1X protocol packets sent out of the port to 802.1X clients:

interface view. N/A
interface-number
3. Remove the VLAN tags of By default, whether the device removes

all 802.1X protocol the VLAN tags of all 802.1X protocol
packets sent out of the dot1x eapol untag packets sent out of a port to 802.1X
port to 802.1X clients. clients depends on the configuration in
the VLAN module.
Setting the maximum number of 802.1X

authentication attempts for MAC authenticated
users
When a port uses both 802.1X authentication and MAC authentication, the device accepts 802.1X
authentication requests from MAC authenticated users. If a MAC authenticated user passes 802.1X
authentication, the user will come online as an 802.1X user. If the user fails 802.1X authentication,
the user continues to make 802.1X authentication attempts depending on client configuration.
Perform this task to limit the number of 802.1X authentication attempts made by a MAC
authenticated user.
To set the maximum number of 802.1X authentication attempts for MAC authenticated users on a
port:

interface view. N/A
interface-number
3. Set the maximum number
of 802.1X authentication By default, the number of 802.1X
attempts for MAC dot1x after-mac-auth authentication attempts for MAC
authenticated users on max-attempt max-attempts authenticated users is not limited on a
the port. port.
40
Configuring 802.1X MAC address binding
Overview
This feature can automatically bind MAC addresses of authenticated 802.1X users to the users'
access port and generate 802.1X MAC address binding entries. You can also use the dot1x
mac-binding mac-address command to manually add 802.1X MAC address binding entries.
802.1X MAC address binding entries never age out. They can survive a user logoff or a device
reboot. If users in the 802.1X MAC address binding entries perform 802.1X authentication on
another port, they cannot pass authentication.

When you configure the 802.1X MAC address binding feature on a port, follow these restrictions and
guidelines:
• The 802.1X MAC address binding feature takes effect only when the port performs MAC-based
access control.
• To delete an 802.1X MAC address binding entry, you must use the undo dot1x mac-binding
mac-address command. An 802.1X MAC address binding entry cannot be deleted when the
user in the entry is online.
• After the number of 802.1X MAC address binding entries reaches the upper limit of concurrent
802.1X users (set by using the dot1x max-user command), the following restrictions exist:
{ Users not in the binding entries will fail authentication even after users in the binding entries
go offline.
{ New 802.1X MAC address binding entries are not allowed.
To configure the 802.1X MAC address binding feature on a port:

2. Enter interface view. interface interface-type interface-number N/A
3. Enable the 802.1X
MAC address By default, the feature is
dot1x mac-binding enable
binding feature. disabled.
4. (Optional.) Manually
add an 802.1X MAC By default, no 802.1X
address binding dot1x mac-binding mac-address MAC address binding
entry. entries exist on a port.
Configuring the EAD assistant feature

When you configure the EAD assistant feature, follow these restrictions and guidelines:
• You must disable MAC authentication and port security globally before you enable the EAD
assistant feature.
• To make the EAD assistant feature take effect on an 802.1X-enabled port, you must set the port
authorization mode to auto.
41
• For the 802.1X guest VLAN or guest VSI feature to work correctly, do not enable EAD assistant
together with the 802.1X guest VLAN or guest VSI feature.
• When global MAC authentication or port security is enabled, the free IP does not take effect.
• If you use the free IP and Auth-Fail VLAN features together, make sure the resources in the
Auth-Fail VLAN are on the free IP segments.
• To allow a user to obtain a dynamic IP address before it passes 802.1X authentication, make
sure the DHCP server is on the free IP segment.
• The server that provides the redirect URL must be on the free IP accessible to unauthenticated
users.
• To avoid using up ACL resources when a large number of EAD users exist, you can shorten the
EAD rule timer.
To configure the EAD assistant feature:

2. Enable the EAD assistant
feature. dot1x ead-assistant enable By default, this feature is disabled.
dot1x ead-assistant free-ip

3. Configure a free IP. ip-address { mask-length | By default, no free IPs exist.
mask-address }
By default, no redirect URL exists.
Configure the redirect URL if users will
use Web browsers to access the
network.
4. (Optional.) Configure the dot1x ead-assistant url To redirect the HTTPS requests of
redirect URL. url-string 802.1X users, specify the HTTPS
redirect listening port on the device. For
more information, see HTTP redirect in
Layer 3—IP Services Configuration
Guide.
5. (Optional.) Set the EAD dot1x timer ead-timeout
rule timer. The default setting is 30 minutes.
ead-timeout-value
Enabling logging for 802.1X users

Overview
This feature enables the device to generate logs for 802.1X users and send the logs to the
information center. For the logs to be output correctly, you must also configure the information center
on the device. For more information about information center configuration, see Network
Management and Monitoring Configuration Guide.

As a best practice, disable this feature to prevent excessive output of logs for 802.1X users.
To enable logging for 802.1X users:
42
By default, all types of logging are
dot1x access-user log enable disabled for 802.1X users.
2. Enable logging for 802.1X [ abnormal-logoff | failed-login | If you do not specify any
users. normal-logoff | parameters, this command
successful-login ] * enables all types of logging for
802.1X users.
Displaying and maintaining 802.1X

Execute display commands in any view and reset commands in user view.
Task Command
Display 802.1X session information,
display dot1x [ sessions | statistics ] [ interface interface-type
statistics, or configuration information of
interface-number ]
specified or all ports.
display dot1x connection [ open ] [ interface interface-type
(In standalone mode.) Display online
interface-number | slot slot-number | user-mac mac-address |
802.1X user information.
user-name name-string ]
display dot1x connection [ open ] [ chassis chassis-number
(In IRF mode.) Display online 802.1X
slot slot-number | interface interface-type interface-number |
user information.
user-mac mac-address | user-name name-string ]
Display MAC address information of display dot1x mac-address { auth-fail-vlan | auth-fail-vsi |
802.1X users in specific 802.1X VLANs critical-vlan | critical-vsi | guest-vlan | guest-vsi } [ interface
or VSIs. interface-type interface-number ]
reset dot1x statistics [ interface interface-type
Clear 802.1X statistics.
interface-number ]
Remove users from the 802.1X guest reset dot1x guest-vlan interface interface-type
VLAN on a port. interface-number [ mac-address mac-address ]
Remove users from the 802.1X guest reset dot1x guest-vsi interface interface-type interface-number
VSI on a port. [ mac-address mac-address ]
802.1X authentication configuration examples

Basic 802.1X authentication configuration example
Network requirements
As shown in Figure 12, the access device performs 802.1X authentication for users that connect to
GigabitEthernet 1/0/1. Implement MAC-based access control on the port, so the logoff of one user
does not affect other online 802.1X users.
Use RADIUS servers to perform authentication, authorization, and accounting for the 802.1X users.
If RADIUS authentication fails, perform local authentication on the access device.
Configure the RADIUS server at 10.1.1.1/24 as the primary authentication and accounting server,
and the RADIUS server at 10.1.1.2/24 as the secondary authentication and accounting server.
Assign all users to the ISP domain bbb.
43
Set the shared key to name for packets between the access device and the authentication server.
Set the shared key to money for packets between the access device and the accounting server.
Figure 12 Network diagram
For information about the RADIUS commands used on the access device in this example, see
Security Command Reference.
1. Configure the RADIUS servers and add user accounts for the 802.1X users. Make sure the
RADIUS servers can provide authentication, authorization, and accounting services. (Details
not shown.)
2. Assign an IP address to each interface. (Details not shown.)
3. Configure user accounts for the 802.1X users on the access device:
# Add a local network access user with username localuser and password localpass in
plaintext. (Make sure the username and password are the same as those configured on the
RADIUS servers.)
<Device> system-view
[Device] local-user localuser class network
[Device-luser-network-localuser] password simple localpass
# Set the service type to lan-access.
[Device-luser-network-localuser] service-type lan-access
[Device-luser-network-localuser] quit
4. Configure a RADIUS scheme on the access device:
# Create a RADIUS scheme named radius1 and enter RADIUS scheme view.
[Device] radius scheme radius1
# Specify the IP addresses of the primary authentication and accounting RADIUS servers.
[Device-radius-radius1] primary authentication 10.1.1.1
[Device-radius-radius1] primary accounting 10.1.1.1
# Configure the IP addresses of the secondary authentication and accounting RADIUS servers.
[Device-radius-radius1] secondary authentication 10.1.1.2
[Device-radius-radius1] secondary accounting 10.1.1.2
# Specify the shared key between the access device and the authentication server.
[Device-radius-radius1] key authentication simple name
# Specify the shared key between the access device and the accounting server.
[Device-radius-radius1] key accounting simple money
# Exclude the ISP domain names from the usernames sent to the RADIUS servers.
[Device-radius-radius1] user-name-format without-domain
[Device-radius-radius1] quit
44
NOTE:
The access device must use the same username format as the RADIUS server. If the RADIUS
server includes the ISP domain name in the username, so must the access device.
5. Configure an ISP domain on the access device:

# Create an ISP domain named bbb and enter ISP domain view.
[Device] domain bbb
# Apply RADIUS scheme radius1 to the ISP domain, and specify local authentication as the
secondary authentication method.
[Device-isp-bbb] authentication lan-access radius-scheme radius1 local
[Device-isp-bbb] authorization lan-access radius-scheme radius1 local
[Device-isp-bbb] accounting lan-access radius-scheme radius1 local
[Device-isp-bbb] quit
6. Configure 802.1X on the access device:
# Enable 802.1X on GigabitEthernet 1/0/1.
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] dot1x
# Enable MAC-based access control on the port. By default, the port uses MAC-based access
control.
[Device-GigabitEthernet1/0/1] dot1x port-method macbased
# Specify ISP domain bbb as the mandatory domain.
[Device-GigabitEthernet1/0/1] dot1x mandatory-domain bbb
[Device-GigabitEthernet1/0/1] quit
# Enable 802.1X globally.
[Device] dot1x
7. Configure the 802.1X client. If an iNode client is used, do not select the Carry version info
option in the client configuration. (Details not shown.)
Verifying the configuration
# Verify the 802.1X configuration on GigabitEthernet 1/0/1.
[Device] display dot1x interface gigabitethernet 1/0/1
# Display the user connection information after an 802.1X user passes authentication.
[Device] display dot1x connection
802.1X guest VLAN and authorization VLAN configuration

example
As shown in Figure 13, use RADIUS servers to perform authentication, authorization, and
accounting for 802.1X users that connect to GigabitEthernet 1/0/2. Implement port-based access
control on the port.
Configure VLAN 10 as the 802.1X guest VLAN on GigabitEthernet 1/0/2. The host and the update
server are both in VLAN 10, and the host can access the update server and download the 802.1X
client software.
After the host passes 802.1X authentication, the access device assigns the host to VLAN 5 where
GigabitEthernet 1/0/3 is. The host can access the Internet.
45
1. Configure the RADIUS server to provide authentication, authorization, and accounting services.
Configure user accounts and authorization VLAN (VLAN 5 in this example) for the users.
(Details not shown.)
2. Create VLANs, and assign ports to the VLANs on the access device.
[Device] vlan 1
[Device-vlan1] port gigabitethernet 1/0/2
[Device-vlan1] quit
[Device] vlan 10
[Device-vlan10] quit
[Device] vlan 2
[Device-vlan2] quit
[Device] vlan 5
[Device-vlan5] quit
# Create RADIUS scheme 2000 and enter RADIUS scheme view.
[Device] radius scheme 2000
# Specify the server at 10.11.1.1 as the primary authentication server, and set the
authentication port to 1812.
46
[Device-radius-2000] primary authentication 10.11.1.1 1812
# Specify the server at 10.11.1.1 as the primary accounting server, and set the accounting port
to 1813.
[Device-radius-2000] primary accounting 10.11.1.1 1813
# Set the shared key to abc in plain text for secure communication between the authentication
server and the device.
[Device-radius-2000] key authentication simple abc
# Set the shared key to abc in plain text for secure communication between the accounting
[Device-radius-2000] key accounting simple abc
# Exclude the ISP domain names from the usernames sent to the RADIUS server.
[Device-radius-2000] user-name-format without-domain
[Device-radius-2000] quit
# Create ISP domain bbb and enter ISP domain view.
[Device] domain bbb
# Apply RADIUS scheme 2000 to the ISP domain for authentication, authorization, and
accounting.
[Device-isp-bbb] authentication lan-access radius-scheme 2000
[Device-isp-bbb] authorization lan-access radius-scheme 2000
[Device-isp-bbb] accounting lan-access radius-scheme 2000
# Implement port-based access control on the port.
[Device-GigabitEthernet1/0/2] dot1x port-method portbased
# Set the port authorization mode to auto. By default, the port uses the auto mode.
[Device-GigabitEthernet1/0/2] dot1x port-control auto
# Specify VLAN 10 as the 802.1X guest VLAN on GigabitEthernet 1/0/2.
[Device-GigabitEthernet1/0/2] dot1x guest-vlan 10
[Device] dot1x
6. Configure the 802.1X client. Make sure the 802.1X client can update its IP address after the
access port is assigned to the guest VLAN or an authorization VLAN. (Details not shown.)
# Verify the 802.1X guest VLAN configuration on GigabitEthernet 1/0/2.
[Device] display dot1x interface gigabitethernet 1/0/2
# Verify that GigabitEthernet 1/0/2 is assigned to VLAN 10 before any user passes authentication on
the port.
[Device] display vlan 10
# After a user passes authentication, display information on GigabitEthernet 1/0/2. Verify that
GigabitEthernet 1/0/2 is assigned to VLAN 5.
[Device] display interface gigabitethernet 1/0/2
47
802.1X with ACL assignment configuration example
As shown in Figure 14, the host that connects to GigabitEthernet 1/0/1 must pass 802.1X
authentication to access the Internet.
Perform 802.1X authentication on GigabitEthernet 1/0/1. Use the RADIUS server at 10.1.1.1 as the
authentication and authorization server, and the RADIUS server at 10.1.1.2 as the accounting
server.
Configure ACL assignment on GigabitEthernet 1/0/1 to deny access of 802.1X users to the FTP
server from 8:00 to 18:00 on weekdays.
RADIUS server cluster

Auth: 10.1.1.1
Acct: 10.1.1.2
GE1/0/2
GE1/0/1 GE1/0/3
Vlan-int2
Internet
192.168.1.1/24
Host Device FTP server
192.168.1.10/24 10.0.0.1/24
1. Configure the RADIUS servers to provide authentication, authorization, and accounting
services. Add user accounts and specify the ACL (ACL 3000 in this example) for the users.
2. Assign an IP address to each interface, as shown in Figure 14. (Details not shown.)
# Specify the server at 10.1.1.1 as the primary authentication server, and set the authentication
port to 1812.
# Specify the server at 10.1.1.2 as the primary accounting server, and set the accounting port to
1813.
48
[Device] domain bbb
accounting.
5. Configure a time range named ftp from 8:00 to 18:00 on weekdays on the access device.
[Device] time-range ftp 8:00 to 18:00 working-day
6. Configure ACL 3000 to deny packets destined for the FTP server at 10.0.0.1 during the
specified time range on the access device.
[Device] acl advanced 3000
[Device-acl-ipv4-adv-3000] rule 0 deny ip destination 10.0.0.1 0 time-range ftp
[Device-acl-ipv4-adv-3000] quit
[Device] dot1x
8. Configure the 802.1X client. Make sure the client is able to update its IP address after the
access port is assigned to the 802.1X guest VLAN or an authorization VLAN. (Details not
shown.)
# Use the user account to pass authentication. (Details not shown.)
# Verify that the user cannot ping the FTP server at any time from 8:00 to 18:00 on any weekday.
C:\>ping 10.0.0.1
Pinging 10.0.0.1 with 32 bytes of data:
Request timed out.

Request timed out.
Request timed out.
Request timed out.
Ping statistics for 10.0.0.1:

Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
The output shows that ACL 3000 is active on the user, and the user cannot access the FTP server.
49
802.1X guest VSI and authorization VSI configuration
example
As shown in Figure 15:
• The device acts as both a VXLAN VTEP and a network access device. It uses the RADIUS
server to perform authentication, authorization, and accounting for 802.1X users that connect to
GigabitEthernet 1/0/2.
• GigabitEthernet 1/0/2 uses MAC-based access control and is configured with the 802.1X guest
VSI. VXLAN 10 is created on the guest VSI. Users in the guest VSI can access the update
server in VXLAN 10 and download the 802.1X client software.
• The RADIUS server assigns an authorization VSI to the host. The VSI is associated with
VXLAN 5 on the device. After passing authentication, the host can access the Internet.
Update server RADIUS server
VXLAN 10
VLAN 1
VXLAN 5
GE1/0/2
Device
(VTEP)
Internet
Host
GE1/0/2 is moved to VXLAN 10 on
the guest VSI
Update server RADIUS server Update server RADIUS server

VXLAN 10
VXLAN 10
User passes authentication
VLAN 1 VLAN 1 VXLAN 5

VXLAN 5
GE1/0/2 GE1/0/2
Device Device
(VTEP) (VTEP)
Internet Internet
Host Host
1. Configure the RADIUS server to provide authentication, authorization, and accounting services.
Configure user accounts and authorization VSI (VSI vpn5 in this example) for the users.
If an H3C ADCAM server is used for authentication and authorization, configure VSIs on the
server. The server will assign these VSIs to the device. You do not need to configure VSIs on
the device.
2. Enable L2VPN on the access device.
50
[Device] l2vpn enable
3. Create VSIs and the corresponding VXLANs on the access device.
[Device] vsi vpn10
[Device-vsi-vpn10] vxlan 10
[Device-vsi-vpn10-vxlan-10] quit
[Device-vsi-vpn10] quit
[Device] vsi vpn5
[Device-vsi-vpn5] vxlan 5
[Device-vsi-vpn5-vxlan-5] quit
[Device-vsi-vpn5] quit
# Specify the server at 10.11.1.1 as the primary authentication server, and set the
authentication port to 1812.
# Specify the server at 10.11.1.1 as the primary accounting server, and set the accounting port
to 1813.
# Exclude the ISP domain names from the usernames sent to the authentication and
accounting servers.
[Device] domain bbb
accounting of LAN users.
# Set the port authorization mode to auto. By default, the port uses the auto mode.
[Device-GigabitEthernet1/0/2] dot1x port-control auto
# Enable MAC-based traffic match mode for dynamic Ethernet service instances on
GigabitEthernet 1/0/2.
[Device-GigabitEthernet1/0/2] mac-based ac
# Enable 802.1X unicast trigger on GigabitEthernet 1/0/2.
51
[Device-GigabitEthernet1/0/2] dot1x unicast-trigger
# Specify VSI vpn10 as the 802.1X guest VSI on GigabitEthernet 1/0/2.
[Device-GigabitEthernet1/0/2] dot1x guest-vsi vpn10
[Device] dot1x
7. Configure the 802.1X client. Make sure the 802.1X client can update its IP address after the
access port is assigned to the guest VSI or an authorization VSI. (Details not shown.)
# Verify that GigabitEthernet 1/0/2 is assigned to VSI vpn10 if no responses are received from the
client after 802.1X authentication is triggered.
[Device] display l2vpn forwarding ac verbose
# Verify that GigabitEthernet 1/0/2 is assigned to VSI vpn5 after a user passes authentication on the
port.
[Device] display l2vpn forwarding ac verbose
802.1X with EAD assistant configuration example (with

DHCP relay agent)
• The intranet 192.168.1.0/24 is attached to GigabitEthernet 1/0/1 of the access device.
• The hosts use DHCP to obtain IP addresses.
• A DHCP server and a Web server are deployed on the 192.168.2.0/24 subnet for users to
obtain IP addresses and download client software.
Deploy an EAD solution for the intranet to meet the following requirements:
• Allow unauthenticated users and users that have failed 802.1X authentication to access
192.168.2.0/24. The users can obtain IP addresses and download software.
• If these users use a Web browser to access a network other than 192.168.2.0/24, redirect them
to the Web server for 802.1X client downloading.
• Allow authenticated 802.1X users to access the network.
52
1. Make sure the DHCP server, the Web server, and the authentication servers have been
configured correctly. (Details not shown.)
2. Configure an IP address for each interface. (Details not shown.)
3. Configure DHCP relay:
# Enable DHCP.
[Device] dhcp enable
# Enable the DHCP relay agent on VLAN-interface 2.
[Device] interface vlan-interface 2
[Device-Vlan-interface2] dhcp select relay
# Specify the DHCP server 192.168.2.2 on the relay agent interface VLAN-interface 2.
[Device-Vlan-interface2] dhcp relay server-address 192.168.2.2
[Device-Vlan-interface2] quit
4. Configure a RADIUS scheme:
port to 1812.
1813.
53
5. Configure an ISP domain:
[Device] domain bbb
accounting.
6. Configure 802.1X:
# Configure the free IP.
[Device] dot1x ead-assistant free-ip 192.168.2.0 24
# Configure the redirect URL for client software download.
[Device] dot1x ead-assistant url http://192.168.2.3
# Enable the EAD assistant feature.
[Device] dot1x ead-assistant enable
[Device] dot1x

# Verify the 802.1X configuration.
[Device] display dot1x
# Verify that you can ping an IP address on the free IP subnet from a host.
C:\>ping 192.168.2.3
Reply from 192.168.2.3: bytes=32 time<1ms TTL=128


Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
The output shows that you can access the free IP subnet before passing 802.1X authentication.
# Verify that you are redirected to the Web server when you enter in your Web browser an IP address
not on the free IP. (Details not shown.)
54
802.1X with EAD assistant configuration example (with
DHCP server)
• The intranet 192.168.1.0/24 is attached to GigabitEthernet 1/0/1 of the access device.
• The hosts use DHCP to obtain IP addresses.
• A Web server is deployed on the 192.168.2.0/24 subnet for users to download client software.
Deploy an EAD solution for the intranet to meet the following requirements:
• Allow unauthenticated users and users that have failed 802.1X authentication to access
192.168.2.0/24. The users can download software.
• If these users use a Web browser to access a network other than 192.168.2.0/24, redirect them
to the Web server for 802.1X client downloading.
• Allow authenticated 802.1X users to access the network.
1. Make sure the Web server and the authentication servers have been configured correctly.
2. Configure an IP address for each interface. (Details not shown.)
3. Configure the DHCP server:
# Enable DHCP.
[Device] dhcp enable
# Enable the DHCP server on VLAN-interface 2.
[Device] interface vlan-interface 2
[Device-Vlan-interface2] dhcp select server
[Device-Vlan-interface2] quit
# Create DHCP address pool 0.
55
[Device] dhcp server ip-pool 0
# Specify subnet 192.168.1.0/24 in DHCP address pool 0.
[Device-dhcp-pool-0] network 192.168.1.0 mask 255.255.255.0
# Specify the gateway address 192.168.1.1 in DHCP address pool 0.
[Device-dhcp-pool-0] gateway-list 192.168.1.1
[Device-dhcp-pool-0] quit
4. Configure a RADIUS scheme:
port to 1812.
1813.
5. Configure an ISP domain:
[Device] domain bbb
accounting.
6. Configure 802.1X:
# Configure the free IP.
[Device] dot1x ead-assistant free-ip 192.168.2.0 24
# Configure the redirect URL for client software download.
[Device] dot1x ead-assistant url http://192.168.2.3
# Enable the EAD assistant feature.
[Device] dot1x ead-assistant enable
[Device] dot1x
56
# Verify the 802.1X configuration.
[Device] display dot1x
# Verify that you can ping an IP address on the free IP subnet from a host.
C:\>ping 192.168.2.3


Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
The output shows that you can access the free IP subnet before passing 802.1X authentication.
# Verify that you are redirected to the Web server when you enter in your Web browser an IP address
not on the free IP. (Details not shown.)
Troubleshooting 802.1X
EAD assistant URL redirection failure
Symptom
Unauthenticated users are not redirected to the specified redirect URL after they enter external
website addresses in their Web browsers.
Analysis
Redirection will not happen for one of the following reasons:
• The address is in the string format. The operating system of the host regards the string as a
website name and tries to resolve the string. If the resolution fails, the operating system sends
an ARP request, but the target address is not in the dotted decimal notation. The redirection
feature does redirect this kind of ARP request.
• The address is within a free IP segment. No redirection will take place, even if no host is present
with the address.
• The redirect URL is not in a free IP segment.
• No server is using the redirect URL, or the server with the URL does not provide Web services.
Solution
To resolve the issue:
1. Enter a dotted decimal IP address that is not in any free IP segments.
2. Verify that the access device and the server are configured correctly.
3. If the issue persists, contact H3C Support.
57

18 802.1X Configuration

Uploaded by

Copyright:

Available Formats

18 802.1X Configuration

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

18 802.1X Configuration

Uploaded by

Copyright:

Available Formats

Contents

802.1X overview ··············································································1

Controlled/uncontrolled port and port

PAE Ethernet type 2

Value Type Description

EAP over RADIUS

802.1X authentication initiation

802.1X client as the initiator

Access device as the initiator

Comparing EAP relay and EAP termination

(3) EAP-Response/Identity (4) RADIUS Access-Request

(7) EAP-Response/MD5-Challenge (8) RADIUS Access-Request

The following steps describe the 802.1X authentication procedure:

Access control methods

802.1X VLAN manipulation

Remote VLAN authorization

VLAN information Authorization VLAN selection

Port access control

Authentication status VLAN manipulation

MAC-based access control

Authentication status VLAN manipulation

MAC-based access control

Authentication status VLAN manipulation

Authentication status VLAN manipulation

MAC-based access control

Authentication status VLAN manipulation

Critical voice VLAN

802.1X VSI manipulation

802.1X support for VXLANs

Authentication status VSI manipulation

Authentication status VSI manipulation

Using 802.1X authentication with other features

Redirect URL assignment

802.1X configuration restrictions and guidelines

802.1X configuration task list

Step Command Remarks

2. Enable 802.1X globally. By default, 802.1X is disabled

4. Enable 802.1X on a port. By default, 802.1X is disabled

Step Command Remarks

By default, the access device performs EAP

Setting the port authorization state

3. Set the port authorization dot1x port-control

Specifying an access control method

Setting the maximum number of concurrent

Step Command Remarks

Setting the maximum number of authentication

Step Command Remarks

Setting the 802.1X authentication timeout timers

Step Command Remarks

Configuring online user handshake

Configuration restrictions and guidelines

Step Command Remarks

5. (Optional.) Enable the online

Configuring 802.1X offline detection

Step Command Remarks

3. Enter interface view. interface interface-type

Configuring 802.1X unauthenticated user aging

Configuration restrictions and guidelines

Step Command Remarks

3. Enter interface view. interface interface-type