Administrator Guide

Security Commands 932
Command Mode
Interface Configuration mode, Interface Range mode
User Guidelines
The authentication manager must be enabled for this command to have
effect.
This command is only applicable to IEEE 802.1X authentication with a
RADIUS server. It has no effect on any other authentication method.
This parameter is independent of, and does not control, the number of times
the authenticator will attempt to contact the RADIUS servers. For example, if
the max-retries for a single configured RADIUS server is set to 3 and the max-
attempts is set to 2, on a supplicant login attempt, the authenticator will send
up to three access requests to the RADIUS server before returning failure.
The authenticator will then re-invoke supplicant authentication method
which allows the RADIUS back end to again send up to three requests to the
RADIUS server before the authenticator allows IEEE 802.1x to stop
supplicant authentication and to invoke the quiet period for the supplicant.
This command sets the limit for retring failed authentications for RADIUS.
The switch attempts authentication based on the selected method and if
authentication returns an error (as opposed to a failure), the next
authentication method is attempted regardless of this setting.
For example, if one or multiple RADIUS servers are configured and no
RADIUS server responds to the authentication message, RADIUS returns an
error and the next authentication method is attempted even when the retry
parameter is configured to a value larger than 1.
Example
The following example configures the switch to allow IEEE 802.1X
supplicants to fail authentication (e.g., enter incorrect passwords) three times
before invoking the quiet timer on the interface.
console#conf
console(config)#authentication enable
console(config)#interface gi1/0/3
console(config-if-Gi1/0/3)#authentication order dot1x
console(config-if-Gi1/0/3)#authentication event fail retry 3