Administrator Guide

70 Switch Feature Overview
• ICMP storms: Ports on which ICMP storms are detected are error-
disabled. The rate limit and burst sizes are configurable separately for IPv4
and IPv6.
• PML: Interfaces on which the port security violation is configured to shut
down the interface are error-disabled when a violation occurs.
• Loop Protect: Loop protection diagnostically disables ports on which a
loop is detected. A log message may be issued when a port is disabled by
Loop Protection.
• BPDU Guard: An interface that receives a BPDU with BPDU guard
enabled is error-disabled. Use the
spanning-tree bpdu-protection
command to enable BPDU guard.
A port that is error-disabled may be returned to service using the no
shutdown command. Alternatively, the operator may configure the auto
recovery service to return the error disabled ports to service after a
configurable period of time. Refer to the errdisable recovery command for
more information.
Captive Portal
The Captive Portal feature blocks clients from accessing the network until
user verification has been established. When a user attempts to connect to
the network through the switch, the user is presented with a customized Web
page that might contain username and password fields or the acceptable use
policy. Users can be required to be authenticated by a local or remote
RADIUS database before access is granted.
For information about configuring the Captive Portal features, see "Captive
Portal " on page 313.
802.1X Authentication (IEEE 802.1X)
802.1X authentication enables the authentication of system users through a
local internal server or an external server. Only authenticated and approved
system users can transmit and receive frames over the port. Supplicants are
authenticated using the Extensible Authentication Protocol (EAP). EAP-
MD5 authentication with no privacy protocol is supported for switch-
initiated (server-side) authentication to remote authentication servers. Local
(IAS) authentication and MAB authentication support EAP-MD5 only.
Encrypted communication with authentication servers is not supported;