H3C S5120-SI Series, Руководство по эксплуатации

Страница: 368 / 697

1-15
To do… Use the command… Remarks
Enter system view
system-view
—
Enter Ethernet interface view
interface interface-type
interface-number
—
Specify the port authorization
mode for the port
dot1x port-control
{ authorized-force | auto |
unauthorized-force }
Optional
auto by default
Specify the port access control
method for the port dot1x port-method
{ macbased | portbased }
Optional
macbased by default
Set the maximum number of
users for the port
dot1x max-user user-number
Optional
256 by default
Note that:
z
Enabling 802.1X on a port is mutually exclusive with adding the port to an aggregation group.
z
For a user-side device sending untagged traffic, the voice VLAN function and 802.1X are mutually
exclusive and cannot be configured together on the same port. For details about voice VLAN, refer
to VLAN Configuration .
z
In EAP relay authentication mode, the device encapsulates the 802.1X user information in the EAP
attributes of RADIUS packets and sends the packets to the RADIUS server for authentication. In
this case, you can configure the user-name-format command but it does not take effect. For
information about the user-name-format command, refer to AAA Commands.
z
If the username of a client contains the version number or one or more blank spaces, you can
neither retrieve information nor disconnect the client by using the username. However, you can use
items such as IP address and connection index number to do so.
Enabling the Online User Handshake Function
The online user handshake function allows the device to send handshake messages to online users to
check whether the users are still online at the interval specified by the dot1x timer handshake-period
command. If the device does not receive any response from an online user after the device has sent the
handshake packet for the maximum number of times, which is set by the dot1x retry command, the
device will set the user state to offline.
Follow these steps to configure the online user handshake function:
To do… Use the command… Remarks
Enter system view
system-view
—
Enter Ethernet interface view
interface interface-type
interface-number
—
Enable the online handshake
function
dot1x handshake
Optional
Enabled by default