H3C SOHO IE4300, Справочник по командам

Страница: 1985 / 3296

39
•
In a high-performance network with quick authentication response, set the quiet timer to a low
value.
•
In a network with authentication servers of different performance, adjust the server timeout
timer.
The network device uses the following 802.1X timers:
•
EAD rule timer (
ead-timeout
) —Sets the lifetime of each EAD rule. When the timer expires
or the user passes authentication, the rule is removed. If users fail to download the EAD client
or fail to pass authentication before the timer expires, they must reconnect to the network to
access the free IP.
•
Handshake timer ( handshake-period ) —Sets the interval at which the access device
sends client handshake requests to check the online status of a client that has passed
authentication. If the device does not receive a response after sending the maximum number of
handshake requests, it considers that the client has logged off.
•
Quiet timer (
quiet-period
) —Starts when a client fails authentication. The access device
must wait the time period before it can process the authentication attempts from the client.
•
Periodic reauthentication timer (
reauth-period
) —Sets the interval at which the network
device periodically reauthenticates online 802.1X users. To enable 802.1X periodic
reauthentication on a port, use the
dot1x re-authenticate
command.
•
Server timeout timer (
server-timeout
) —Starts when the access device sends a RADIUS
Access-Request packet to the authentication server. If no response is received when this timer
expires, the 802.1X authentication fails.
To avoid forced logoff before the server timeout timer expires, set the server timeout timer to a
value that is lower than or equal to the product of the following values:

The maximum number of RADIUS packet transmission attempts set by using the
retry
command in RADIUS scheme view.

The RADIUS server response timeout timer set by using the
timer response-timeout
command in RADIUS scheme view.
For information about setting the maximum number of RADIUS packet transmission attempts
and the RADIUS server response timeout timer, see AAA configuration in
Security
Configuration Guide .
•
Client timeout timer (
supp-timeout
) —Starts when the access device sends an
EAP-Request/MD5-Challenge packet to a client. If no response is received when this timer
expires, the access device retransmits the request to the client.
•
Username request timeout timer (
tx-period
) —Starts when the device sends an
EAP-Request/Identity packet to a client in response to an authentication request. If the device
does not receive a response before this timer expires, it retransmits the request. The timer also
sets the interval at which the network device sends multicast EAP-Request/Identity packets to
detect clients that cannot actively request authentication.
•
User aging timer (
user-aging
) —Sets the user aging timer for a type of 802.1X VLAN.
If you enable 802.1X unauthenticated user aging, you can set a user aging timer for Auth-Fail,
critical, or guest VLANs. The user aging timer for a type of 802.1X VLAN determines how long a
user can stay in that type of VLAN.
For more information about how user aging operates, see the usage guidelines for the
dot1x
unauthenticated-user aging enable
command.
Do not set a user aging timer to a multiple of the username request timeout timer (the
dot1x
timer tx-period
command). If you do so, the aging timer will not take effect.
The change to the periodic reauthentication timer applies to the users that have been online only
after the old timer expires. Other timer changes take effect immediately on the device.