Users Guide

Table Of Contents

Security Commands 988

to be able to identify the short-comings in the configuration of a 802.1x

authentication on the switch without affecting the network access to the

users of the switch.

There are three important aspects to this feature after activation:

To allow successful authentications using the returned information from

authentication server.

To provide a mechanism to report unsuccessful authentications without

negative repercussions to the user due to operator errors or failure cases

from the Authentication server or supplicants.

To accurately report the data received from the successful and

unsuccessful operations so that the operator can make the appropriate

changes or learn where the problem areas are.

The monitor mode can be configured globally on a switch. If the switch fails

to authenticate the user for any reason (say RADIUS access reject from

RADIUS server, RADIUS time-out, or the client itself is 802.1x unaware), the

client is authenticated and is undisturbed by the failure condition(s). The

reasons for failure are logged and buffered into the local logging database such

that the operator can track the failure conditions. Clients authenticated when

monitor mode is enabled are always assigned to the default port PVID if no

VLAN is supplied from the RADIUS server, and clients are assigned to

RADIUS VLAN if filter-ID is a mismatch.

Commands in this Section

This section explains the following commands:

dot1x dynamic-vlan enable dot1x system-auth-control server-key

dot1x eapolflood dot1x system-auth-control

monitor

show dot1x

dot1x initialize dot1x timeout quiet-period show dot1x authentication-

history

mab dot1x timeout re-

authperiod

show dot1x clients

default mab dot1x timeout server-

timeout

show dot1x interface