H3C SOHO IE4300, Command Reference Manual

Page: 1961 / 3296

15
Views
Layer 2 Ethernet interface view
Predefined user roles
network-admin
Usage guidelines
By default, the device sends EAP-Failure packets to 802.1X clients when the client users are
assigned to the 802.1X critical VLAN. Some 802.1X clients, such as Windows built-in 802.1X clients,
cannot respond to the EAP-Request/Identity packets from the device for reauthentication if they
have received an EAP-Failure packet. As a result, reauthentication for these clients will fail after the
authentication server becomes reachable.
To avoid this situation, enable the device to send EAP-Success packets instead of EAP-Failure
packets to 802.1X clients when the client users are assigned to the 802.1X critical VLAN.
Examples
# Send an EAP-Success packet to a client when the 802.1X client user is assigned to the 802.1X
critical VLAN on GigabitEthernet 1/0/1.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] dot1x critical eapol
Related commands
dot1x critical vlan
dot1x critical vlan
Use
dot1x critical vlan
to configure an 802.1X critical VLAN on a port.
Use
undo dot1x critical vlan
to restore the default.
Syntax
dot1x critical vlan critical-vlan-id
undo dot1x critical vlan
Default
No 802.1X critical VLAN exists on a port.
Views
Layer 2 Ethernet interface view
Predefined user roles
network-admin
Parameters
critical-vlan-id : Specifies the ID of the 802.1X critical VLAN on the port. The value range for
the VLAN ID is 1 to 4094. Make sure the VLAN has been created.
Usage guidelines
An 802.1X critical VLAN accommodates users that fail 802.1X authentication because all the
RADIUS servers in their ISP domains are unreachable. Users in the critical VLAN can access a
limited set of network resources depending on the configuration.
To delete a VLAN that has been configured as an 802.1X critical VLAN, you must first use the
undo
dot1x critical vlan
command.