75
Online user handshake
The online user handshake feature checks the connectivity status of online 802.1X users. The
access device sends handshake messages to online users at the handshake interval. If the device
does not receive any responses from an online user after it has made the maximum handshake
attempts, the device sets the user to offline state.
You can also enable the online user handshake security feature to check authentication information
in the handshake packets from clients. With this feature, the device prevents 802.1X users who use
illegal client software from bypassing iNode security check such as dual network interface cards
(NICs) detection.
Authentication trigger
The access device initiates authentication, if a client cannot send EAPOL-Start packets. One
example is the 802.1X client available with Windows XP.
The access device supports the following modes:
•
Unicast trigger mode
—Upon receiving a frame from an unknown MAC address, the access
device sends an Identity EAP-Request packet out of the receiving port to the MAC address. The
device retransmits the packet if no response has been received within the specified interval.
•
Multicast trigger mode
—The access device multicasts Identity EAP-Request packets
periodically (every 30 seconds by default) to initiate 802.1X authentication.
Auth-Fail VLAN
The 802.1X Auth-Fail VLAN on a port accommodates users who have failed 802.1X authentication
because of the failure to comply with the organization's security strategy. For example, the VLAN
accommodates users who have entered a wrong password. The Auth-Fail VLAN does not
accommodate 802.1X users who have failed authentication for authentication timeouts or network
connection problems.
The access device handles VLANs on an 802.1X-enabled port based on its 802.1X access control
method.
On a port that performs port-based access control:
Authentication status
VLAN manipulation
A user fails 802.1X
authentication.
The device assigns the Auth-Fail VLAN to the port as the PVID. All 802.1X
users on this port can access only resources in the Auth-Fail VLAN.
A user in the 802.1X
Auth-Fail VLAN fails 802.1X
reauthentication
The Auth-Fail VLAN is still the PVID on the port, and all 802.1X users on this
port are in this VLAN.
A user passes 802.1X
authentication.
•
The device assigns the authorization VLAN of the user to the port as the
PVID, and it removes the port from the Auth-Fail VLAN. After the user
logs off, the guest VLAN is assigned to the port as the PVID. If no guest
VLAN is configured, the initial PVID of the port is restored.
•
If the authentication server does not authorize a VLAN, the initial PVID
of the port applies. The user and all subsequent 802.1X users are
assigned to the initial PVID. After the user logs off, the PVID remains
unchanged.
