80
Setting the port authorization state
The port authorization state determines whether the client is granted access to the network. You can
control the authorization state of a port by using the
dot1x port-control
command and the following
keywords:
•
authorized-force
—Places the port in the authorized state, enabling users on the port to access the
network without authentication.
•
unauthorized-force
—Places the port in the unauthorized state, denying any access requests from
users on the port.
•
auto
—Places the port initially in the unauthorized state to allow only EAPOL packets to pass, and
after a user passes authentication, sets the port in the authorized state to allow access to the network.
You can use this option in most scenarios.
You can set authorization state for one port in Ethernet interface view, or for multiple ports in system view.
If different authorization state is set for a port in system view and Ethernet interface view, the one set later
takes effect.
To set the authorization state of a port:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Set the port
authorization state.
•
In system view:
dot1x port-control
{
authorized-force
|
auto
|
unauthorized-force
} [
interface
interface-list
]
•
In Ethernet interface view:
a.
interface
interface-type
interface-number
b.
dot1x port-control
{
authorized-force
|
auto
|
unauthorized-force
}
Optional.
Use either method.
By default,
auto
applies.
Specifying an access control method
You can specify an access control method for one port in Ethernet interface view, or for multiple ports in
system view. If different access control methods are specified for a port in system view and Ethernet
interface view, the one specified later takes effect.
To use both 802.1X and portal authentication on a port, you must specify MAC-based access control. For
information about portal authentication, see "
Configuring portal authentication
To specify the access control method:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
