H3C S9500E Series, Руководство по настройке безопасности

Страница: 77 / 207

77
To do… Use the command… Remarks
8. Set timers
dot1x timer { handshake-
period
handshake-period-value |
quiet-period quiet-period-value |
reauth-period reauth-period-
value | server-timeout server-
timeout-value | supp-timeout
supp-timeout-value |
tx-period
tx-
period-value }
Optional
The defaults are as follows:
15 seconds for the handshake
timer,
60 seconds for the quiet timer,
3600 seconds for the periodic re-
authentication timer,
100 seconds for the server timeout
timer,
30 seconds for the client timeout
timer, and
30 seconds for the username
request timeout timer.
•
For 802.1X to take effect on a port, you must enable it both globally and on the port.
•
You can enable 802.1X and specify the port authorization mode, port access control method, and
maximum number of users for a port in both system view and interface view. For more information about
the configuration, see Configuring 802.1X for a port . The only difference between global configurations
and configurations on a port lies in the applicable scope. If both a global setting and a local setting exist
for an argument of a port, the one configured later takes effect.
•
When enabling both portal and 802.1X authentication on a port, set the access control method to
macbased . For more information about portal authentication, see Portal in the Security Configuration
Guide.
•
802.1X timers only need to be changed in special or extreme network environments. For example, you
can give the client timeout timer a higher value in a low-performance network, give the quiet timer a
higher value in a vulnerable network or a lower value for quicker authentication response, or adjust the
server timeout timer to suit the performance of different authentication servers.
Configuring 802.1X for a port
Enabling 802.1X for a port
Follow these steps to enable 802.1X for a port:
To do… Use the command… Remarks
1. Enter system view
system-view —
2. Enable 802.1X for
one or more ports
In system
view dot1x interface interface-
list
Required
Use either approach.
Disabled by default
In Ethernet
interface
interface interface-type
interface-number