94
Configuration restrictions and guidelines
When you configure 802.1X reauthentication, follow these restrictions and guidelines:
•
The server-assigned session timeout timer (Session-Timeout attribute) and termination action
(Termination-Action attribute) together can affect periodic reauthentication. To display the
server-assigned Session-Timeout and Termination-Action attributes, use the
display dot1x
connection
command (see
Security Command Reference
).
{
If the termination action is
Default
(logoff), periodic reauthentication on the device takes
effect only when the periodic reauthentication timer is shorter than the session timeout
timer.
{
If the termination action is
Radius-request
, the periodic reauthentication configuration on
the device does not take effect. The device reauthenticates the online 802.1X users after
the session timeout timer expires.
Support for the assignment of Session-Timeout and Termination-Action attributes depends on
the server model.
•
You can set the periodic reauthentication timer either in system view or in interface view by
using the
dot1x timer reauth-period
command. A change to the periodic reauthentication
timer applies to online users only after the old timer expires.
The device selects a periodic reauthentication timer for 802.1X reauthentication in the following
order:
a.
Server-assigned reauthentication timer.
b.
Port-specific reauthentication timer.
c.
Global reauthentication timer.
d.
Default reauthentication timer.
•
The VLANs assigned to an online user before and after reauthentication can be the same or
different.
Configuring 802.1X periodic reauthentication
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
(Optional.) Set the global
periodic reauthentication
timer.
dot1x timer reauth-period
reauth-period-value
The default is 3600 seconds.
3.
Enter Ethernet interface
view.
interface
interface-type
interface-number
N/A
4.
Enable 802.1X periodic
reauthentication.
dot1x re-authenticate
By default, the feature is disabled.
5.
(Optional.) Set the periodic
reauthentication timer on the
port.
dot1x timer
reauth-period
reauth-period-value
By default, no periodic
reauthentication timer is set on a
port. The port uses the global
802.1X periodic reauthentication
timer.
Configuring 802.1X manual reauthentication
Step Command
Remarks
1.
Enter system view.
system-view
N/A
Содержание FlexFabric 5940 SERIES
Страница 251: ...238 ...
