55
CHAPTER 3
INTRODUCTION TO CLI
Explanation:
The maximum number of times the switch transmits an EAPOL Request Identity frame without receiving
a response before adding a port to the Guest VLAN. The value can only be changed when the Guest VLAN option is
globally enabled. The range is 1 – 255.
Parameters:
<value:1-255>: Specify a value between 1 and 255.
Negation:
(config)# no dot1x max-reauth-req
3.9.8.11 (config-if)# dot1x port-control
Syntax:
(config-if)# dot1x port-control { force-authorized | force-unauthorized | auto | single | multi | mac-based }
Parameters:
{ force-authorized | force-unauthorized | auto | single | multi | mac-based }: Specify one of the authentication
modes on the selected interfaces. This setting works only when NAS is globally enabled. The following modes are
available:
force-authorized:
In this mode, the switch will send one EAPOL Success frame when the port link comes up,
and any client on the port will be allowed network access without authentication.
force unauthorized:
In this mode, the switch will send one EAPOL Failure frame when the port link comes
up, and any client on the port will be disallowed network access.
auto (Port-Based 802.1X):
This mode requires a dot1x-aware client to be authorized by the authentication
server. Clients that are not dot1x-aware will be denied access.
single (802.1X):
In Single 802.1X, at most one supplicant can get authenticated on the port at a time. Normal
EAPOL frames are used in the communication between the supplicant and the switch. If more than one
supplicant is connected to a port, the one that comes first when the port's link comes up will be the first one
considered. If that supplicant doesn't provide valid credentials within a certain amount of time, another
supplicant will get a chance. Once a supplicant is successfully authenticated, only that supplicant will be
allowed access. This is the most secure of all the supported modes. In this mode, the “Port Security” module
is used to secure a supplicant's MAC address once successfully authenticated.
multi (802.1X):
In Multi 802.1X, one or more supplicants can get authenticated on the same port at the
same time. Each supplicant is authenticated individually and secured in the MAC table using the “Port
Security” module.
mac-based:
Unlike port-based 802.1X, MAC-based authentication do not transmit or receive EAPOL frames.
In MAC-based authentication, the switch acts as the supplicant on behalf of clients. The initial frame (any
kind of frame) sent by a client is snooped by the switch, which in turn uses the client's MAC address as both
username and password in the subsequent EAP exchange with the RADIUS server. The 6-byte MAC address
is converted to a string on the following form "xx-xx-xx-xx-xx-xx", that is, a dash (-) is used as separator
between the lower-cased hexadecimal digits. The switch only supports the MD5-Challenge authentication
method, so the RADIUS server must be configured accordingly.
Example:
Set Gigabit Ethernt port 1-10’s admin state to “auto”
# config t
(config)# interface gigabitethernet 1/1-10
(config-if)# dot1x port-control auto
Содержание MSW-4424C Series
Страница 1: ...1 MSW 4424C MSW 4424CS L2 Gigabit Carrier Ethernet Switch ...
Страница 382: ......
