CLI Guide

Table Of Contents

Security Commands 1066

to be able to identify the short-comings in the configuration of a 802.1x

authentication on the switch without affecting the network access to the

users of the switch.

There are three important aspects to this feature after activation:

To allow successful authentications using the returned information from

authentication server.

To provide a mechanism to report unsuccessful authentications without

negative repercussions to the user due to operator errors or failure cases

from the Authentication server or supplicants.

To accurately report the data received from the successful and

unsuccessful operations so that the operator can make the appropriate

changes or learn where the problem areas are.

The monitor mode can be configured globally on a switch. If the switch fails

to authenticate the user for any reason (say RADIUS access reject from

RADIUS server, RADIUS time-out, or the client itself is 802.1x unaware), the

client is authenticated and is undisturbed by the failure condition(s). The

reasons for failure are logged and buffered into the local logging database such

that the operator can track the failure conditions. Clients authenticated when

monitor mode is enabled are always assigned to the default port PVID if no

VLAN is supplied from the RADIUS server, and clients are assigned to

RADIUS VLAN if filter-ID is a mismatch.

Commands in this Section

This section explains the following commands:

dot1x eapolflood dot1x system-auth-control server-key

dot1x eapolflood authentication monitor show dot1x

clear authentication

sessions

dot1x timeout show authentication

authentication-history

mab authentication timer

reauthenticate

show authentication clients

default mab auth-type show dot1x interface

mab request format auth-type show dot1x interface

statistics