79
Configuration procedure
To enable 802.1X on a port:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable 802.1X globally.
dot1x
By default, 802.1X is
disabled globally.
3.
Enable 802.1X on a
port.
•
In system view
:
dot1x
interface
interface-list
•
In Ethernet interface view:
a.
interface
interface-type
interface-number
b.
dot1x
Use either method.
By default, 802.1X is
disabled on a port.
Enabling EAP relay or EAP termination
When you configure EAP relay or EAP termination, consider the following factors:
•
The support of the RADIUS server for EAP packets
•
The authentication methods supported by the 802.1X client and the RADIUS server
If the client is using only MD5-Challenge EAP authentication or the "us password" EAP
authentication initiated by an HP iNode 802.1X client, you can use both EAP termination and EAP relay.
To use EAP-TL, PEAP, or any other EAP authentication methods, you must use EAP relay. When you make
your decision, see "
A comparison of EAP relay and EAP termination
" for help.
For more information about EAP relay and EAP termination, see "
802.1X authentication procedures
."
To configure EAP relay or EAP termination:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Configure EAP relay or
EAP termination.
dot1x
authentication-method
{
chap
|
eap
|
pap
}
Optional.
By default, the network access device
performs EAP termination and uses CHAP to
communicate with the RADIUS server.
Specify the
eap
keyword to enable EAP
termination.
Specify the
chap
or
pap
keyword to enable
CHAP-enabled or PAP-enabled EAP relay.
NOTE:
If EAP relay mode is used, the
user-name-format
command configured in RADIUS scheme view does not
take effect. The access device sends the authentication data from the client to the server without any
modification.
