99
By default, when a reachable RADIUS server is detected, the system removes the port or 802.1X users
from the critical VLAN without triggering authentication.
The
dot1x critical recovery-action
command takes effect only for the 802.1X users in the critical VLAN on
a port. It enables the port to take one of the following actions to trigger 802.1X authentication after
removing 802.1X users from the critical VLAN on detection of a reachable RADIUS authentication server:
•
If MAC-based access control is used, the port sends a unicast Identity EAP/Request to each 802.1X
user.
•
If port-based access control is used, the port sends a multicast Identity EAP/Request to all the
802.1X users attached to the port.
Examples
# Configure GigabitEthernet 1/0/1 to trigger 802.1X re-authentication on detection of an active
RADIUS authentication server for users in the critical VLAN.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/1
[Sysname-GigabitEthernet1/0/1] dot1x critical recovery-action reinitialize
dot1x domain-delimiter
Syntax
dot1x domain-delimiter
string
undo dot1x domain-delimiter
View
System view
Default level
2: System level
Parameters
string
: Specifies a set of 1 to 16 domain name delimiters for 802.1X users. No space is required between
delimiters. Available delimiters include the at sign (@), back slash (\), forward slash (/), and dot (.).
Description
Use
dot1x domain-delimiter
to specify a set of domain name delimiters supported by the access device.
Use
undo dot1x domain-delimiter
to restore the default.
By default, the access device supports only the at sign (@) delimiter for 802.1X users.
Any character in the configured set can be used as the domain name delimiter for 802.1X authentication
users.
The delimiter set you configured overrides the default setting. If the at sign (@) is not included in the
delimiter set, the access device does not support the 802.1X users that use the at sign (@) as the domain
name delimiter.
If a username string contains multiple configured delimiters, the leftmost delimiter is the domain name
delimiter. For example, if you configure the at sign (@),the forward slash (/), and the back slash (\) as
delimiters, the domain name delimiter for the username string 123/22\@abc is the forward slash (/).
