73
•
MAC-based access control: With this method configured on a port, all users of the port must
be authenticated separately, and when a user logs off, no other users are affected.
802.1X timers
This section describes the timers used on an 802.1X switch to guarantee that the client, the switch,
and the RADIUS server can interact with each other in a reasonable manner.
•
Username request timeout timer (
tx-period
): This timer is triggered by the switch in two
cases. The first case is when the client requests for authentication. The switch starts this timer
when it sends an EAP-Request/Identity packet to a client. If it receives no response before this
timer expires, the switch retransmits the request. The second case is when the switch
authenticates the 802.1X client that cannot request for authentication actively. The switch
sends multicast EAP-Request/Identity packets periodically through the port enabled with
802.1X function. In this case, this timer sets the interval between sending the multicast EAP-
Request/Identity packets.
•
Client timeout timer (
supp-timeout
): Once a switch sends an EAP-Request/MD5 Challenge
packet to a client, it starts this timer. If this timer expires but it receives no response from the
client, it retransmits the request.
•
Server timeout timer (
server-timeout
): Once a switch sends a RADIUS Access-Request
packet to the authentication server, it starts this timer. If this timer expires but it receives no
response from the server, it retransmits the request.
•
Handshake timer (
handshake-period
): After a client passes authentication, the switch
sends to the client handshake requests at this interval to check whether the client is online. If
the switch receives no response after sending the allowed maximum number of handshake
requests, it considers that the client is logged off.
•
Quiet timer (
quiet-period
): When a client fails the authentication, the switch refuses further
authentication requests from the client in this period of time.
•
Periodic re-authentication timer (
reauth-period
): If periodic re-authentication is enabled on
a port, the switch re-authenticates online users on the port at the interval specified by this
timer.
Features working together with 802.1X
VLAN assignment
After an 802.1X user passes the authentication, the server will send an authorization message to
the switch. If the server is configured with the VLAN assignment function, the assigned VLAN
information will be included in the message. The switch, depending on the link type of the port
used to log on, adds the port to the assigned VLAN according to the following rules:
•
If the port link type is Access, the port leaves its initial VLAN, that is, the VLAN configured for
it and joins the assigned VLAN.
•
If the port link type is Trunk, the assigned VLAN is allowed to pass the current trunk port. The
default VLAN ID of the port is that of the assigned VLAN.
