CTC Union GSW-3208M1, User Manual

Page: 37 / 240

34
dot1x agetime x
command is used to set aging time. “
x
” is a number
between 10~10000000 in seconds.
This setting applies to the following modes, i.e. modes using the Port Security
functionality to secure MAC addresses:
• Single 802.1X
• Multi 802.1X
• MAC-Based Auth.
When the NAS module uses the Port Security module to secure MAC
addresses, the Port Security module needs to check for activity on the MAC
address in question at regular intervals and free resources if no activity is
seen within a given period of time. This parameter controls exactly this period
and can be set to a number between 10 and 1000000 seconds.
If reauthentication is enabled and the port is in an 802.1X-based mode, this is
not so critical, since supplicants that are no longer attached to the port will get
removed upon the next reauthentication, whi ch will fail. But if reauthentication
is not enabled, the only way to free resources is by aging the entries.
For ports in MAC-based Auth. mode, reauthentication doesn't cause direct
communication between the switch and the client, so this will not detect
whether the client is still attached or not, and the only way to free any
resources is to age the entry.
dot1x eapoltimeout x
command is used to determine the time for
retransmission of Request Identity EAPOL frames.
“
x
” is a number between
1~65535 in seconds. This has no effect for MAC-based ports.
dot1x guest_vlan
command is used to enable Guest VLAN function. And
“
no dot1x guest_vlan
” command is used to disable it. When it is enabled,
the individual ports' ditto setting determines whether the port c an be moved
into Guest VLAN. The port setting is configured in port configuring interface
under prompt “(config-if)#”.
A Guest VLAN is a special VLAN - typically with limited network access - on
which 802.1X-unaware clients are placed after a network admi nistrator-
defined timeout. This option is only available for EAPOL-based modes, i.e.:
•
Port-based 802.1X
•
Single 802.1X
•
Multi 802.1X
While in the Guest VLAN, the switch monitors the link for EAPOL frames, and if
one such frame is received, the switch immediately takes the port out of the
Guest VLAN and starts authenticating the supplicant according to the port
mode. If an EAPOL frame is received, the port will never be able to go back
into the Guest VLAN if the "allow_if_eapol_seen" is disabled.
dot1x guest_vlan vid x
command is used to set the VLAN ID of Guest VLAN.
“
x
” is a number between 1~4095 for VLAN ID.
dot1x holdtime x
command is used to set the Hold Time for 802.1x operation.
“
x
” is a number between 10~10000000 for time in seconds.
This setting applies to the following modes, i.e. modes using the Port Security
functionality to secure MAC addresses: