Ruijie RG-S2900G-E Series, Configuration Manual

Page: 549 / 943

Configuration Guide 802.1x Configuration
Other Precautions for Configuring 802.1x

Concurrent use of 1X and ACL
In the non-IP authorization mode, if you enable the 802.1x authentication function of a port and at the same time associate
one ACL with a interface, the ACL takes effect on the basis of the MAC address. In other words, only the packets from the
source MAC addresses of the authenticated users can pass ACL filtering, and the packets from other source MAC
addresses will be discarded. The ACL can only work on the basis of the MAC address.
For example, if the authenticated MAC address is 00d0.f800.0001, then all the packets from the source MAC address of
00d0.f800.0001 can be switched. If the port is associated with an ACL, the ACL will further filter these packets that can be
switched, for example, rejecting the ICMP packets from the source MAC address of 00d0.f800.0001.

The restrictions for the condition that the users on the interface have being authenticated or the users have been
authenticated:
The port mode cannot be modified, such as the command switchport mode trunk cannot be used.
The port Access VLAN can not be modified in the ACCESS mode.
The port Allowed VLAN and Native VLAN can not be modified in the TRUNK mode.
The port can not exit from or be added to the AP port.

The restrictions for the condition that the users in the VLAN have being authenticated or the users have been
authenticated:
VLAN can not be deleted
VLAN type cannot be modified, such as the command private-vlan primary cannot be used.

GVRP cannot be co-used with the dynamic VLAN auto-switching function.

802.1x function can be co-used with other access control functions, such as the port security, IP+MAC binding,ect.
When those access control functions are co-used, the packets can enter the switch on the condition that those
packets must address all access controls.

After the Native VLAN of the port is changed, effective VLAN-switching functions (such as: GUEST VLAN, FAIL
VLAN, VLAN assignment and IAB authentication with switching VLAN) on the Trunk port or Hybrid port will cause the
users in other VLANs can access the network without authorization. Therefore, it is suggest the aforementioned
VLAN-switching function is enabled on the Access port only.

It is not suggested to enable the dot1x redirect command after the controlled function is enabled on the AP port.
Otherwise, controlled function of this AP port may fail.
Typical 802.1X Configuration Examples
802.1X-based AAA Services
Network Topology
Figure 12 Network topology for the 802.1X-based AAA service